Alpine Linux Docker Image CVE-2019-5021 Hard Coded Credentials Authentication Bypass Vulnerability

Bugtraq ID:	108288
Class:	Design Error
CVE:	CVE-2019-5021
Remote:	Yes
Local:	No
Published:	May 08 2019 12:00AM
Updated:	May 08 2019 12:00AM
Credit:	Peter Adkins of Cisco Umbrella.
Vulnerable:	Alpine Linux Docker Edge 0 Alpine Linux Docker 3.9 Alpine Linux Docker 3.8 Alpine Linux Docker 3.7 Alpine Linux Docker 3.6 Alpine Linux Docker 3.5 Alpine Linux Docker 3.4 Alpine Linux Docker 3.3
Not Vulnerable:	Alpine Linux Docker Edge 20190228 snapshot Alpine Linux Docker 3.9.2 Alpine Linux Docker 3.8.4 Alpine Linux Docker 3.7.3 Alpine Linux Docker 3.6.5

Alpine Linux Docker Image CVE-2019-5021 Hard Coded Credentials Authentication Bypass Vulnerability

Alpine Linux Docker Image is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to gain unauthorized access or obtain sensitive information; this may lead to further attacks.

Alpine Linux Docker Image CVE-2019-5021 Hard Coded Credentials Authentication Bypass Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Alpine Linux Docker Image CVE-2019-5021 Hard Coded Credentials Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Alpine Linux Docker Image CVE-2019-5021 Hard Coded Credentials Authentication Bypass Vulnerability

References:

• alpine: builds from new upstream #5516 (docker-library)
  
• Alpine Linux Docker Image root User Hard-Coded Credential Vulnerability (talosintelligence.com)
  
• Alpine Linux Homepage (AlpineLinux)
  
• Docker Image Vulnerability (CVE-2019-5021) (alpinelinux.org)
  
• scripts/genrootfs.sh: make sure root login is disabled (alpinelinux.org)