Security researchers from Cisco disclosed information about the vulnerability (CVE-2019-5021) in the Alpine distribution for the Docker container isolation system. The essence of the identified issue is that an empty password was set by default for the root user without blocking direct login as root. It is worth noting that Alpine is used to create the official images from the Docker project (previously, official builds were based on Ubuntu, but they were to Alpine).
The issue manifests starting with Alpine Docker version 3.3 and was caused by a regression change added in 2015 (prior to version 3.3, the line 'root:!::0:::::' was used in /etc/shadow, but after the discontinuation of the '-d' flag, the line 'root:::0:::::' began to be added). The issue was initially discovered and in November 2015, but in December it was mistakenly included again in the build files of the experimental branch, and then was transferred to stable builds.
The vulnerability details indicate that the problem is also present in the latest branch of Alpine Docker 3.9. In March, Alpine developers released a fix and the vulnerability starting with builds 3.9.2, 3.8.4, 3.7.3, and 3.6.5, but remains in the older branches 3.4.x and 3.5.x, which are no longer supported. Furthermore, the developers claim that the attack vector is highly limited and requires the attacker to have access to the same infrastructure.
Source: opennet.ru
