Skip to content
OpenAdvisories
Critical · 9.8 CVE-2019-5021 EUVD-2019-14628GHSA-m3hq-qcc9-75f6

Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to…

Published May 8, 2019 · Updated Aug 4, 2024 · Assigned by talos

Platform: Linux

Description

Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.

Affected products

VendorProductAffectedFixed
— Alpine Linux Alpine Docker 3.3 Alpine Docker 3.4 Alpine Docker 3.5 Alpine Docker 3.6 Alpine Docker 3.7 Alpine Docker 3.8 Alpine Docker 3.9 Alpine Docker Edge —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP1 system-user-root 20190513-3.3.1 SUSE-SU-2019:1368-2
SLES 15 system-user-root 20190513-3.3.1 SUSE-SU-2019:1368-1
SLES 12 suse-sles12sp3-image 2.0.2-22.1 SUSE-SU-2019:1368-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.1 system-user-root 20190513-lp151.3.3.1 openSUSE-SU-2019:1495-1
openSUSE Leap 15.0 system-user-root 20190513-lp151.3.3.1 openSUSE-SU-2019:1495-1

Advisories 3

References