CVE-2020-35195: Critical severity docker haproxy vulnerability
Published Dec 17, 2020
·Updated
The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
Affected Software
1 affected component
Docker haproxy docker image<1.8.18
Event History
Dec 17, 2020
CVE Published
via MITRE·01:11 AM
Data Sourced
via MITRE·01:11 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2020-35195.
2
What is the severity of CVE-2020-35195?
The severity of CVE-2020-35195 is critical.
3
How does CVE-2020-35195 impact haproxy docker images?
CVE-2020-35195 allows a remote attacker to achieve root access with a blank password in haproxy docker images before version 1.8.18-alpine.
4
What software versions are affected by CVE-2020-35195?
Versions of the haproxy docker image up to, but not including, 1.8.18 are affected by CVE-2020-35195.
5
How can I fix CVE-2020-35195?
To fix CVE-2020-35195, update to version 1.8.18-alpine or later of the haproxy docker image.