3 ms·
Note the conditional: "systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the s
by lallysingh 8y ago
Note the conditional:
"systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user"
So if you're not using a container running ssh/etc, it doesn't affect you.
Serious question: what's the use of PAM in a docker image that's vulnerable here?
- scandinavian 8y agoFor sshd you would have to set PermitEmptyPasswords to yes for it to matter, right?
- raesene9 8y agoand also PermitRootLogin, AFAIK
- antod 8y agoI also note they could run head on /etc/shadow without sudo > docker run -it alpine:3.$i head -n 1 /etc/shadow The container process itself is running as the locally namespaced root account anyway. From my possibly incorrect interpretation... unless you are trying to build containers like VMs with multiple users and init etc, this null root password issue seems irrelevant.