CVE-2019-5021 Hardcoded credentials in Alpine Linux
Official Alpine Linux Docker images contain a NULL password for root, allowing attackers to gain root access if PAM or shadow file authentication is used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-5021?
CVE-2019-5021 is a critical vulnerability in Opensuse Leap, published on 8 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.
Weakness: CWE-258
Which versions are affected by CVE-2019-5021?
It affects 3 products.
Linux distribution packages (5)
system-user-root SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 20190513-3.3.1 |
system-user-root SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 20190513-3.3.1 |
suse-sles12sp3-image SUSE:Linux Enterprise Module for Containers 12 | All versions | 2.0.2-22.1 |
system-user-root openSUSE:Leap 15.0 | All versions | 20190513-lp151.3.3.1 |
system-user-root openSUSE:Leap 15.1 | All versions | 20190513-lp151.3.3.1 |
Products include F5 Big-Ip Controller, Gliderlabs Docker-Alpine, Opensuse Leap.
How do I fix CVE-2019-5021?
Upgrade to a fixed version.
Is CVE-2019-5021 being exploited?
There is no known exploitation of CVE-2019-5021 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Leap
Sources
Also known as CVE-2020-29589, CVE-2020-29590, CVE-2020-35188, CVE-2020-35194, GHSA-m3hq-qcc9-75f6, SUSE-SU-2019:1368-1 and 3 more.