Official Docker Alpine Linux images, starting from version 3.3, contain an empty root password. When using PAM or another authentication mechanism that relies on the /etc/shadow file as a source, the system may allow the root user to log in with an empty password. Update the base image version or manually modify the /etc/shadow file.
The vulnerability has been fixed in the versions:
- edge (20190228 snapshot)
- v3.9.2
- v3.8.4
- v3.7.3
- v3.6.5
Source: linux.org.ru
