CVE-2019-0204 Docker image code execution with Apache Mesos

What is CVE-2019-0204?

CVE-2019-0204 is a high-severity vulnerability in Apache Mesos, published on 25 Mar 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host.

Which versions are affected by CVE-2019-0204?

8 open source packages ship an affected version, including org.apache.mesos:mesos. It affects 2 products.

Products include Apache Mesos, Redhat Fuse.

How do I fix CVE-2019-0204?

Upgrade org.apache.mesos:mesos to a fixed version for your release line: 1.4.3, 1.5.3, 1.6.2 or 1.7.2.

Is CVE-2019-0204 being exploited?

There is no known exploitation of CVE-2019-0204 in the wild and no public exploit code.

Other vulnerabilities in Apache Mesos

• CVE-2019-5736 Privilege escalation in n/a High 8.6
• CVE-2018-11793 Stack Overflow in Apache Mesos High 7.5
• CVE-2018-1330 Crash when decoding malformed HTTP requests or malformed JSON payload High 7.5
• CVE-2017-7687 Denial of service in Apache Mesos High 7.5
• CVE-2017-9790 Use after free in Apache Mesos High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-32w9-2qpc-5f9v.