Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 4 products
2019: las imágenes de Alpine en docker dejan de usar root sin hash de contraseña por culpa de CVE-2019-5021 y usan el carácter !, pero esto rompía las claves ssh. Así que en 2022, Alpine decide volver a usar el * como hash de root sin contraseña.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | alpinelinux | alpine_linux | - | - | - |
| App | f5 | big-ip_controller | 1.2.1 | cloud_foundry | - |
| App | gliderlabs | docker-alpine | - | - | - |
| OS | opensuse | leap | 15.0 | - | - |
| OS | opensuse | leap | 15.1 | - | - |