CVE-2019-5021
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the ...
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.
- Record
CVE-2019-5021- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-258
- Updated
- 2026-11-02
EUVDEUVD-2019-14628
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.
- Record
EUVD-2019-14628- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m3hq-qcc9-75f6
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the ...
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.
- Record
GHSA-m3hq-qcc9-75f6- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798
- Updated
- 2026-11-02
NVD
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.
- Record
CVE-2019-5021- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-258
- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1495-1 No score
Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root
This update for sles12sp3-docker-image, sles12sp4-image, system-user-root fixes the following issues:
- CVE-2019-5021: Include an invalidated root password by default, not an empty one (bsc#1134524)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1495-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1368-1 No score
Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root
This update for sles12sp3-docker-image, sles12sp4-image, system-user-root fixes the following issues:
- CVE-2019-5021: Include an invalidated root password by default, not an empty one (bsc#1134524)
- Record
SUSE-SU-2019:1368-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1368-2 No score
Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root
This update for sles12sp3-docker-image, sles12sp4-image, system-user-root fixes the following issues:
- CVE-2019-5021: Include an invalidated root password by default, not an empty one (bsc#1134524)
- Record
SUSE-SU-2019:1368-2- Updated
- 2026-11-02
OSVSUSE-SU-2021:4011-1 No score
Security update for sles12sp2-docker-image
This update for sles12sp2-docker-image fixes the following issues:
- Invalidate the root password (was empty before) (bsc#1134524 CVE-2019-5021)
Note that SUSE does not recommend use of this image anymore, please use newer versions from the registry.
- Record
SUSE-SU-2021:4011-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
system-user-rootSUSE:Linux Enterprise Module for Basesystem 15 |
before 20190513-3.3.1 | 20190513-3.3.1 |
suse-sles12sp3-imageSUSE:Linux Enterprise Module for Containers 12 |
before 2.0.2-22.1 | 2.0.2-22.1 |
system-user-rootSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 20190513-3.3.1 | 20190513-3.3.1 |
system-user-rootopenSUSE:Leap 15.0 |
before 20190513-lp151.3.3.1 | 20190513-lp151.3.3.1 |
system-user-rootopenSUSE:Leap 15.1 |
before 20190513-lp151.3.3.1 | 20190513-lp151.3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-5021 is a critical vulnerability (CVSS 9.8) in Open Source Alpine Linux, published May 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.26%, the 93rd percentile. Fixed in system-user-root 20190513-3.3.1.
References
securityfocus.com/bid/108288
lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.html
talosintelligence.com/vulnerability_reports/TALOS-2019-0782
security.netapp.com/advisory/ntap-20190510-0001
alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html
support.f5.com/csp/article/K25551452
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-5021
github.com/advisories/GHSA-m3hq-qcc9-75f6
suse.com/support/update/announcement/2019/suse-su-20191368-1
bugzilla.suse.com/1134524