CVE-2019-5021: Critical severity docker alpine vulnerability

Published May 8, 2019

Updated

Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.

Affected Software

5 affected components

Gliderlabs Docker-alpine>=3.3

Alpinelinux Alpine Linux

openSUSE Leap=15.0

openSUSE Leap=15.1

F5 Big-ip Controller Cloud Foundry=1.2.1

Remediation

Patch Available

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782

Event History

May 8, 2019

CVE Published

via MITRE·04:52 PM

Data Sourced

via MITRE·04:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2019-5021?

CVE-2019-5021 is a vulnerability that affects versions of the Official Alpine Linux Docker images since v3.3, where the root user has a NULL password.

What is the severity of CVE-2019-5021?

CVE-2019-5021 has a severity rating of 9.8, which is considered critical.

How does CVE-2019-5021 affect Gliderlabs Docker-alpine?

Gliderlabs Docker-alpine versions since v3.3 are affected by CVE-2019-5021 where the root user has a NULL password.

How can I fix CVE-2019-5021?

To fix CVE-2019-5021, you should update your Alpine Linux Docker images to a version that has addressed the NULL password vulnerability.

Are openSUSE Leap 15.0 and 15.1 affected by CVE-2019-5021?

No, openSUSE Leap 15.0 and 15.1 are not affected by CVE-2019-5021.