CVE-2019-5021

Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.

• CWE-258

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108288Broken Link
• https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.htmlVendor Advisory
• https://security.netapp.com/advisory/ntap-20190510-0001/Third Party Advisory
• https://support.f5.com/csp/article/K25551452Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782Exploit, Mitigation, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00004.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108288Broken Link
• https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.htmlVendor Advisory
• https://security.netapp.com/advisory/ntap-20190510-0001/Third Party Advisory
• https://support.f5.com/csp/article/K25551452Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782Exploit, Mitigation, Patch, Third Party Advisory

Published

May 8, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5015A local privilege escalation vulnerability exists in the Mac…7.8
• CVE-2019-5016An exploitable arbitrary memory read vulnerability exists in…9.1
• CVE-2019-5017An exploitable information disclosure vulnerability exists i…5.3
• CVE-2019-5018An exploitable use after free vulnerability exists in the wi…8.1
• CVE-2019-5019A heap-based overflow vulnerability exists in the PowerPoint…9.8
• CVE-2019-5020An exploitable denial of service vulnerability exists in the…5.5
• CVE-2019-5022Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5023An exploitable vulnerability exists in the grsecurity PaX pa…5.9
• CVE-2019-5024A restricted environment escape vulnerability exists in the …7.6
• CVE-2019-5025Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5026Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5027Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…