« Volver al listado

CVE-2019-0204

Estado: ModificadaAlta (7.8)—

A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Apache — MesosRedhat — Fuse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-0204",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache",
          "product": "Apache Mesos",
          "versions": [
            {
              "status": "affected",
              "version": "pre-1.4.x"
            },
            {
              "status": "affected",
              "version": "1.4.0 to 1.4.2"
            },
            {
              "status": "affected",
              "version": "1.5.0 to 1.5.2"
            },
            {
              "status": "affected",
              "version": "1.6.0 to 1.6.1"
            },
            {
              "status": "affected",
              "version": "1.7.0 to 1.7.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-25T22:29:00.730",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/107605",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:3892",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/107605",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:3892",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host."
    },
    {
      "lang": "es",
      "value": "Una imagen Docker especialmente manipulada que se ejecuta bajo un usuario root puede sobrescribir el binario init helper del tiempo de ejecución del contenedor y/o del ejecutor de comandos en Apache Mesos, en versiones pre-1.4.x, de 1.4.0 a 1.4.2, de 1.5.0 a 1.5.2, de 1.6.0 a 1.6.1 y de 1.7.0 a 1.7.1. Un actor malicioso puede, por lo tanto, lograr la ejecución de código de nivel root en el host."
    }
  ],
  "lastModified": "2026-06-17T02:07:57.773",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA0695E0-954A-4533-9D93-58257E9EA6D5",
              "versionEndExcluding": "1.4.3",
              "versionStartIncluding": "1.4.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B51B8DF0-FCE4-42A7-A582-0476226C6188",
              "versionEndExcluding": "1.5.3",
              "versionStartIncluding": "1.5.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01878119-E05A-469B-B49D-5D19082CED28",
              "versionEndExcluding": "1.6.2",
              "versionStartIncluding": "1.6.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1AB1BB7C-46A1-4676-9D15-D75EC1E4594C",
              "versionEndExcluding": "1.7.2",
              "versionStartIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:mesos:1.8.0:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5262F5B-F30B-42AF-9D48-77041AC709AB"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:fuse:7.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECF2CBAC-69B9-41A5-9999-6C07090A6204"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}