Lucene search

[email protected]NVD:CVE-2019-5021

HistoryMay 08, 2019 - 5:29 p.m.

CVE-2019-5021

2019-05-0817:29:01

CWE-258

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.011

Percentile

84.9%

JSON

Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.

Affected configurations

Nvd

Node

gliderlabsdocker-alpineRange3.3≥

AND

alpinelinuxalpine_linuxMatch-

Node

opensuseleapMatch15.0

opensuseleapMatch15.1

Node

f5big-ip_controllerMatch1.2.1cloud_foundry

VendorProductVersionCPE
gliderlabsdocker-alpine*cpe:2.3:a:gliderlabs:docker-alpine:*:*:*:*:*:*:*:*
alpinelinuxalpine_linux-cpe:2.3:o:alpinelinux:alpine_linux:-:*:*:*:*:*:*:*
opensuseleap15.0cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
opensuseleap15.1cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
f5big-ip_controller1.2.1cpe:2.3:a:f5:big-ip_controller:1.2.1:*:*:*:*:cloud_foundry:*:*

Vendor	Product	Version	CPE
gliderlabs	docker-alpine	*	cpe:2.3:a:gliderlabs:docker-alpine::::::::
alpinelinux	alpine_linux	-	cpe:2.3:o:alpinelinux:alpine_linux:-:::::::*
opensuse	leap	15.0	cpe:2.3:o:opensuse:leap:15.0:::::::*
opensuse	leap	15.1	cpe:2.3:o:opensuse:leap:15.1:::::::*
f5	big-ip_controller	1.2.1	cpe:2.3:a:f5:big-ip_controller:1.2.1:::::cloud_foundry::