Alpine Linux Docker Image CVE-2019-5021 Hard Coded Credentials Authentication Bypass Vulnerability

Alpine Linux Docker Image is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to gain unauthorized access or obtain sensitive information; this may lead to further attacks.

Information

Bugtraq ID: 108288
Class: Design Error
CVE: CVE-2019-5021

Remote: Yes
Local: No
Published: May 08 2019 12:00AM
Updated: May 08 2019 12:00AM
Credit: Peter Adkins of Cisco Umbrella.
Vulnerable: Alpine Linux Docker Edge 0
Alpine Linux Docker 3.9
Alpine Linux Docker 3.8
Alpine Linux Docker 3.7
Alpine Linux Docker 3.6
Alpine Linux Docker 3.5
Alpine Linux Docker 3.4
Alpine Linux Docker 3.3

Not Vulnerable: Alpine Linux Docker Edge 20190228 snapshot
Alpine Linux Docker 3.9.2
Alpine Linux Docker 3.8.4
Alpine Linux Docker 3.7.3
Alpine Linux Docker 3.6.5

Exploit

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

References:

• alpine: builds from new upstream #5516 (docker-library)
  
• Alpine Linux Docker Image root User Hard-Coded Credential Vulnerability (talosintelligence.com)
  
• Alpine Linux Homepage (AlpineLinux)
  
• Docker Image Vulnerability (CVE-2019-5021) (alpinelinux.org)
  
• scripts/genrootfs.sh: make sure root login is disabled (alpinelinux.org)
  

Source: www.securityfocus.com