Critical severity · published May 8, 2019
CVE-2019-5021
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user
9.8
CVSS
6.3%
EPSS
No
On KEV
Description
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Big-ip Controller · F5
1.2.1 · source: NVD
DO
Docker-alpine · Gliderlabs
3.3 and later · source: NVD
LE
Leap · Opensuse
15.0; 15.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5021
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5021
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.html
Broken Link
http://www.securityfocus.com/bid/108288
Vendor Advisory
https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20190510-0001/
Third Party Advisory
https://support.f5.com/csp/article/K25551452
Exploit
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782
More from Big-ip Controller
8.8
CVE-2018-5543
The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which may lead to disclosure of the…