K25551452 : Alpine Linux Docker image vulnerability CVE-2019-5021

Security Advisory Description

Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user. (CVE-2019-5021)

Impact

BIG-IP Controller for Cloud Foundry

An attacker can exploit the vulnerability remotely to gain unauthorized access to the affected system.

BIG-IP / Enterprise Manager / BIG-IQ Centralized Management / F5 iWorkflow / Traffix SDC / BIG-IP Controller for Kubernetes / BIG-IP Controller for Marathon / F5 IPAM Controller

There is no impact; these F5 products are not affected by this vulnerability.