NVD Vulnerability Detail

CVE-2019-5021

Summary	Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.
Publication Date	May 9, 2019, 2:29 a.m.
Registration Date	Jan. 26, 2021, 11:42 a.m.
Last Update	Nov. 21, 2024, 1:44 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:gliderlabs:docker-alpine::::::::		3.3
execution environment
1	cpe:2.3:o:alpinelinux:alpine_linux:-:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_controller:1.2.1:::::cloud_foundry::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.html	Mailing List Third Party Advisory
3	http://www.securityfocus.com/bid/108288	Broken Link
4	http://www.securityfocus.com/bid/108288	Broken Link
5	https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html	Vendor Advisory
6	https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html	Vendor Advisory
7	https://security.netapp.com/advisory/ntap-20190510-0001/	Third Party Advisory
8	https://security.netapp.com/advisory/ntap-20190510-0001/	Third Party Advisory
9	https://support.f5.com/csp/article/K25551452	Third Party Advisory
10	https://support.f5.com/csp/article/K25551452	Third Party Advisory
11	https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782	Exploit Mitigation Patch Third Party Advisory
12	https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782	Exploit Mitigation Patch Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

gliderlabs の docker-alpine 等複数ベンダの製品における脆弱性

Title	gliderlabs の docker-alpine 等複数ベンダの製品における脆弱性
Summary	gliderlabs の docker-alpine 等複数ベンダの製品には、不特定の脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 9, 2019, midnight
Registration Date	July 19, 2024, 12:19 p.m.
Last Update	July 19, 2024, 12:19 p.m.

Affected System

gliderlabs

docker-alpine 3.3 以上

openSUSE project

openSUSE Leap 15.0

openSUSE Leap 15.1

F5 Networks

BIG-IP Controller 1.2.1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-5021	https://www.cve.org/CVERecord?id=CVE-2019-5021
National Vulnerability Database (NVD)
2	CVE-2019-5021	https://nvd.nist.gov/vuln/detail/CVE-2019-5021

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/scap/cwe.html

ベンダー情報

No	Name	URL
gliderlabs
1	DOCKER IMAGE VULNERABILITY (CVE-2019-5021)	https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html
opensuse-security-announce
2	openSUSE-SU-2019:1495-1	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.html
Security Advisory
3	K25551452	https://support.f5.com/csp/article/K25551452

その他

No	Name	URL
関連文書
1	security.netapp.com (ntap-20190510-0001)	https://security.netapp.com/advisory/ntap-20190510-0001/
2	talosintelligence.com (TALOS-2019-0782)	https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782

Change Log

No	Changed Details	Date of change
1	[2024年07月18日] 掲載	July 18, 2024, 4:29 p.m.