Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:4011-1 advisory.

  - Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root`     user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to     the nature of this issue, systems deployed using affected versions of the Alpine Linux container which     utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication     database, may accept a NULL password for the `root` user. (CVE-2019-5021)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for sles12sp3-docker-image, sles12sp4-image, system-user-root fixes the following issues :

  - CVE-2019-5021: Include an invalidated root password by     default, not an empty one (bsc#1134524)

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Severity
156048	SUSE SLES12 Security Update : sles12sp2-docker-image (SUSE-SU-2021:4011-1)	Nessus	SuSE Local Security Checks	critical
125718	openSUSE Security Update : system-user-root (openSUSE-2019-1495)	Nessus	SuSE Local Security Checks	critical
11245	Unpassworded 'root' Account	Nessus	Default Unix Accounts	critical

Detections

Analytics

CVE-2019-5021

critical

Tenable Plugins

critical

critical

critical