{"vulnerability": "cve-2019-5021", "sightings": [{"uuid": "8360cad4-2c1e-4301-aa8e-ea978a1177c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5021", "type": "seen", "source": "https://t.me/BleepingComputer/5085", "content": "194 of The Top 1000 Docker Containers Don\u2019t Have Root Passwords\n\nCisco Talos' discovery that the Alpine Linux distribution Docker image came with a blank root password (CVE-2019-5021) led to the discovery that 194 of the top 1000 most popular Docker containers also have no root passwords. [...]\n\nhttps://www.bleepingcomputer.com/news/security/194-of-the-top-1000-docker-containers-don-t-have-root-passwords/", "creation_timestamp": "2019-05-21T14:10:37.000000Z"}, {"uuid": "22284f75-fdde-492c-989a-bb4c0eae9bae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5021", "type": "published-proof-of-concept", "source": "https://t.me/k8security/171", "content": "\u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 DEEPCE, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0430\u0431\u0440\u0435\u0432\u0438\u0430\u0442\u0443\u0440\u043e\u0439 \u043e\u0442 \u0444\u0440\u0430\u0437\u044b Docker Enumeration, Escalation of Privileges and Container Escapes. \u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u0441\u0430\u043c\u043e \u0437\u0430 \u0441\u0435\u0431\u044f.\n\n\u0414\u043b\u044f \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u0435\u0441\u044c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 sh \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (1234 LoC). \u041d\u043e \u0434\u043b\u044f \u0440\u044f\u0434\u0430 \u0437\u0430\u0434\u0430\u0447 \u043e\u043d \u0432\u0441\u0435 \u0436\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u0442 \u0447\u0442\u043e \u0432\u043d\u0443\u0442\u0440\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u043a\u0430\u0436\u0443\u0442\u0441\u044f \u0442\u0443\u043b\u0437\u044b: curl, nmap, nslookup, dig. \u0422\u0430\u043a\u0436\u0435 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u0439\u0442\u0435, \u0447\u0442\u043e \u043f\u0440\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0440\u044f\u0434\u0430 \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c runC, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0435 - \u0431\u0443\u0434\u044c\u0442\u0435 \u043e\u0441\u0442\u043e\u0440\u043e\u0436\u043d\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0435\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u043d\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043a\u0430\u0447\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0435\u0433\u043e \u0431\u0435\u0437 \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430 \u0434\u0438\u0441\u043a:\n\nwget -O - https://github.com/stealthcopter/deepce/raw/master/deepce.sh | sh\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b:\n- DOCKER     - \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 docker group\n- PRIVILEGED - \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \n- SOCK       - \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 docker sock \n- CVE-2019-5736\n- CVE-2019-5021\n- CVE-2019-13139\n\n\u041f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u043e \u043b\u0438 \u044d\u0442\u043e \u0432 Kubernetes? \u0414\u0430! \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u0430\u0436\u0435 \u0437\u043d\u0430\u0435\u0442 \u043f\u0440\u043e kubectl ;)", "creation_timestamp": "2020-12-22T08:12:31.000000Z"}, {"uuid": "ca065d69-8736-487c-b3d8-d87116b3e0b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5021", "type": "seen", "source": "https://t.me/canyoupwnme/5525", "content": "Enforcing Alpine Linux Docker Images vulnerability (CVE-2019-5021) with Anchore\nhttps://anchore.com/enforcing-alpine-linux-docker-images-vulnerability-cve-2019-5021-with-anchore/", "creation_timestamp": "2019-05-15T12:52:15.000000Z"}, {"uuid": "b3f68d8a-8179-42e5-a633-0059972fbd48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5021", "type": "seen", "source": "https://t.me/oleg_log/971", "content": "\u0427\u0442\u043e \u043d\u0435 \u0443\u0442\u0440\u043e, \u0442\u043e \u043f\u043e\u0434\u0430\u0440\u043e\u043a.\n\nVersions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5021", "creation_timestamp": "2026-08-01T18:00:05.228773Z"}, {"uuid": "9779fd80-5ff5-489e-9680-0a8acd0876ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5021", "type": "seen", "source": "https://t.me/oleg_log/971", "content": "\u0427\u0442\u043e \u043d\u0435 \u0443\u0442\u0440\u043e, \u0442\u043e \u043f\u043e\u0434\u0430\u0440\u043e\u043a.\n\nVersions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5021", "creation_timestamp": "2026-08-02T00:00:23.932926Z"}, {"uuid": "b881fdf7-afc4-4637-89d2-354d81bbd4de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5021", "type": "seen", "source": "https://t.me/oleg_log/971", "content": "\u0427\u0442\u043e \u043d\u0435 \u0443\u0442\u0440\u043e, \u0442\u043e \u043f\u043e\u0434\u0430\u0440\u043e\u043a.\n\nVersions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5021", "creation_timestamp": "2026-07-29T12:01:53.656954Z"}, {"uuid": "d38ee61d-75fc-4cde-9363-cf5e82070be4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5021", "type": "seen", "source": "https://t.me/oleg_log/971", "content": "\u0427\u0442\u043e \u043d\u0435 \u0443\u0442\u0440\u043e, \u0442\u043e \u043f\u043e\u0434\u0430\u0440\u043e\u043a.\n\nVersions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the root user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the root user.\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5021", "creation_timestamp": "2026-07-30T00:02:05.246677Z"}]}