4 ms·
No, it is not an issue, there are no suid binaries at all in the base install, so no way of changing user. The link from the CVE says "Due to the nature of thi
by justincormack 7y ago
No, it is not an issue, there are no suid binaries at all in the base install, so no way of changing user.
The link from the CVE says "Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container that utilize Linux PAM, or some other mechanism that uses the system shadow file as an authentication database, may accept a NULL password for the root user." - so the config would have to install PAM with suid binaries, and configure shadow passwords and not change the password. This is pretty unlikely overall.