Alpine Linux Hard-Coded Root Vulnerability

A root access vulnerability has been disclosed in the official Alpine Linux images hosted on Docker Hub. An unauthenticated attacker could exploit this vulnerability to execute arbitrary code or take control of the affected image.

Threat ID:: CC-3051
Category:
Threat Severity:: Low
Threat Vector:
Published:: 9 May 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

Linux

Alpine Linux - Versions 3.9 and earlier

Threat details

The vulnerability appears to be the result of a regression introduced in December 2015. All Alpine Linux Docker images available through Docker's Hub repository appear to have been shipped with a hard-coded NULL password for the root account. If the affected image deployed using the shadow system file as an authentication database, such as Linux Pluggable Authentication Modules (PAM), it will accept a NULL password for root access.

For further information:

CVE-2019-5021

Remediation steps

Type	Step
	Alpine have addressed this vulnerability in Alpine Linux 3.9.3, available on Docker Hub. User and administrators are encouraged to apply this update immediately. Organisations unable to update are advised to disable root account access on their affected Alpine Linux images.

Type

Step

Alpine have addressed this vulnerability in Alpine Linux 3.9.3, available on Docker Hub. User and administrators are encouraged to apply this update immediately.

Organisations unable to update are advised to disable root account access on their affected Alpine Linux images.

Last edited: 14 February 2020 2:43 pm