Update "empty" password handling in "no-hard-coded-passwords" to balk at an empty root password explicitly (CVE-2019-5021) #5880

tianon · 2019-05-08T20:29:05Z

See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5021, https://manpages.debian.org/stretch/passwd/passwd.5.en.html, https://manpages.debian.org/stretch/passwd/shadow.5.en.html.

… at an empty root password explicitly (CVE-2019-5021)

tianon · 2019-05-08T20:33:24Z

As noted in gliderlabs/docker-alpine#511 (comment), Alpine 3.5 (the last version affected by this) was EOL back on 2018-11-01, but I've included it in my test run below to show the new behavior:

$ ./test/run.sh alpine:3.5 alpine:3.6 alpine:3.7 alpine:3.8 alpine:3.9 alpine:edge
testing alpine:3.5
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...error: empty password detected for 'root'
failed
	'override-cmd' [4/4]...passed
testing alpine:3.6
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed
testing alpine:3.7
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed
testing alpine:3.8
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed
testing alpine:3.9
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed
testing alpine:edge
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed

yosifkit · 2019-05-08T20:58:32Z

While I agree that this is a worthwhile change, I'd like to note that --security-opt=no-new-privileges has been in Docker since 1.11.0 (moby/moby#20727) and completely mitigates this security concern.

yosifkit · 2019-05-08T20:59:26Z

Are there any current images that fail this test now?

tianon · 2019-05-08T22:07:15Z

Skipping Alpine (which I tested above), here's the test run across every other FROM scratch image:

$ ./test/run.sh -t no-hard-coded-passwords $(bashbrew list --uniq --apply-constraints alt amazonlinux busybox centos cirros clearlinux crux debian euleros fedora hello-world mageia nats nats-streaming opensuse oraclelinux photon sl sourcemage swarm traefik ubuntu)
skipping "hello-world:nanoserver-1803" (due to architecture "amd64"; only "windows-amd64" supported)
skipping "hello-world:nanoserver-1809" (due to architecture "amd64"; only "windows-amd64" supported)
skipping "nats:1.4.1-nanoserver" (due to architecture "amd64"; only "windows-amd64" supported)
skipping "nats:1.4.1-windowsservercore" (due to architecture "amd64"; only "windows-amd64" supported)
skipping "nats-streaming:0.14.1-nanoserver" (due to architecture "amd64"; only "windows-amd64" supported)
skipping "nats-streaming:0.14.1-windowsservercore" (due to architecture "amd64"; only "windows-amd64" supported)
skipping "traefik:v2.0.0-alpha4-nanoserver" (due to architecture "amd64"; only "windows-amd64" supported)
skipping "traefik:v1.7.11-nanoserver" (due to architecture "amd64"; only "windows-amd64" supported)
testing alt:p8
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'iputils': 'x'
warning: garbage password detected for 'root': 'x'
passed
testing alt:sisyphus
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'iputils': 'x'
warning: garbage password detected for 'root': 'x'
passed
testing amazonlinux:2.0.20190228
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'root': '*LOCK*'
passed
testing amazonlinux:2.0.20190228-with-sources
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'root': '*LOCK*'
passed
testing amazonlinux:2018.03.0.20190212
	'no-hard-coded-passwords' [1/1]...passed
testing amazonlinux:2018.03.0.20190212-with-sources
	'no-hard-coded-passwords' [1/1]...passed
testing busybox:1.30.1-uclibc
	'no-hard-coded-passwords' [1/1]...error: empty password detected for 'root'
failed
testing busybox:1.30.1-glibc
	'no-hard-coded-passwords' [1/1]...error: empty password detected for 'root'
failed
testing busybox:1.30.1-musl
	'no-hard-coded-passwords' [1/1]...error: empty password detected for 'root'
failed
testing busybox:1.30.1
	'no-hard-coded-passwords' [1/1]...error: empty password detected for 'root'
failed
testing centos:latest
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'root': 'locked'
passed
testing centos:centos6
	'no-hard-coded-passwords' [1/1]...passed
testing centos:centos7.6.1810
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'root': 'locked'
passed
testing centos:centos7.5.1804
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'root': 'locked'
passed
testing centos:centos7.4.1708
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'root': 'locked'
passed
testing centos:centos7.3.1611
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'root': 'locked'
passed
testing centos:centos7.2.1511
	'no-hard-coded-passwords' [1/1]...passed
testing centos:centos7.1.1503
	'no-hard-coded-passwords' [1/1]...error: crypt password detected for 'root': '$1$UKLtvLuY$kka6S665oCFmU7ivSDZzU.'
failed
testing centos:centos7.0.1406
	'no-hard-coded-passwords' [1/1]...error: crypt password detected for 'root': '$1$UKLtvLuY$kka6S665oCFmU7ivSDZzU.'
failed
testing centos:centos6.10
	'no-hard-coded-passwords' [1/1]...passed
testing centos:centos6.9
	'no-hard-coded-passwords' [1/1]...passed
testing centos:centos6.8
	'no-hard-coded-passwords' [1/1]...passed
testing centos:centos6.7
	'no-hard-coded-passwords' [1/1]...error: crypt password detected for 'root': '$6$QhN6G8YM$LDd5zhqarhgMy6/e1c6wYwbusi4RZBz3lfRNQ1p5VquqtHzIj.Tf9r7cqoaSLgI3FiCPzfePyTBG7omBKv9bF0'
failed
testing centos:centos6.6
	'no-hard-coded-passwords' [1/1]...passed
testing cirros:0.4.0
	'no-hard-coded-passwords' [1/1]...error: crypt password detected for 'cirros': '$1$ecgqyiea$GZzgQPRzx7sFFoZ7p8ewU.'
warning: garbage password detected for 'dbus': 'x'
warning: garbage password detected for 'www-data': 'x'
warning: garbage password detected for 'backup': 'x'
warning: garbage password detected for 'proxy': 'x'
warning: garbage password detected for 'sys': 'x'
warning: garbage password detected for 'mail': 'x'
warning: garbage password detected for 'haldaemon': 'x'
warning: garbage password detected for 'sshd': 'x'
failed
testing clearlinux:latest
	image has no tests...skipping
testing crux:3.4
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'nobody': 'x'
warning: garbage password detected for 'bin': 'x'
warning: garbage password detected for 'daemon': 'x'
warning: garbage password detected for 'messagebus': 'x'
warning: garbage password detected for 'www': 'x'
warning: garbage password detected for 'mail': 'x'
warning: garbage password detected for 'ftp': 'x'
error: empty password detected for 'root'
failed
testing crux:3.2
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'nobody': 'x'
warning: garbage password detected for 'bin': 'x'
warning: garbage password detected for 'daemon': 'x'
warning: garbage password detected for 'messagebus': 'x'
warning: garbage password detected for 'www': 'x'
warning: garbage password detected for 'mail': 'x'
warning: garbage password detected for 'ftp': 'x'
error: empty password detected for 'root'
failed
testing debian:buster
	'no-hard-coded-passwords' [1/1]...passed
testing debian:buster-backports
	'no-hard-coded-passwords' [1/1]...passed
testing debian:buster-slim
	'no-hard-coded-passwords' [1/1]...passed
testing debian:experimental
	'no-hard-coded-passwords' [1/1]...passed
testing debian:jessie
	'no-hard-coded-passwords' [1/1]...passed
testing debian:jessie-slim
	'no-hard-coded-passwords' [1/1]...passed
testing debian:oldstable
	'no-hard-coded-passwords' [1/1]...passed
testing debian:oldstable-slim
	'no-hard-coded-passwords' [1/1]...passed
testing debian:rc-buggy
	'no-hard-coded-passwords' [1/1]...passed
testing debian:sid
	'no-hard-coded-passwords' [1/1]...passed
testing debian:sid-slim
	'no-hard-coded-passwords' [1/1]...passed
testing debian:stable
	'no-hard-coded-passwords' [1/1]...passed
testing debian:stable-backports
	'no-hard-coded-passwords' [1/1]...passed
testing debian:stable-slim
	'no-hard-coded-passwords' [1/1]...passed
testing debian:stretch
	'no-hard-coded-passwords' [1/1]...passed
testing debian:stretch-backports
	'no-hard-coded-passwords' [1/1]...passed
testing debian:stretch-slim
	'no-hard-coded-passwords' [1/1]...passed
testing debian:testing
	'no-hard-coded-passwords' [1/1]...passed
testing debian:testing-slim
	'no-hard-coded-passwords' [1/1]...passed
testing debian:unstable
	'no-hard-coded-passwords' [1/1]...passed
testing debian:unstable-slim
	'no-hard-coded-passwords' [1/1]...passed
testing euleros:2.3.1809
	'no-hard-coded-passwords' [1/1]...passed
testing euleros:2.3.1806
	'no-hard-coded-passwords' [1/1]...passed
testing euleros:2.3.1803
	'no-hard-coded-passwords' [1/1]...passed
testing euleros:2.2
	'no-hard-coded-passwords' [1/1]...passed
testing fedora:27
	'no-hard-coded-passwords' [1/1]...passed
testing fedora:26
	'no-hard-coded-passwords' [1/1]...passed
testing fedora:30
	'no-hard-coded-passwords' [1/1]...passed
testing fedora:28
	'no-hard-coded-passwords' [1/1]...passed
testing fedora:latest
	'no-hard-coded-passwords' [1/1]...passed
testing fedora:rawhide
	'no-hard-coded-passwords' [1/1]...passed
testing hello-world:linux
	image has no tests...skipping
testing mageia:6
	'no-hard-coded-passwords' [1/1]...passed
testing nats:1.4.1-linux
	image has no tests...skipping
testing nats-streaming:0.14.1-linux
	image has no tests...skipping
testing opensuse:42.3
	'no-hard-coded-passwords' [1/1]...error: empty password detected for 'root'
failed
testing oraclelinux:7.6
	'no-hard-coded-passwords' [1/1]...passed
testing oraclelinux:7-slim
	'no-hard-coded-passwords' [1/1]...passed
testing oraclelinux:6.10
	'no-hard-coded-passwords' [1/1]...passed
testing oraclelinux:6-slim
	'no-hard-coded-passwords' [1/1]...passed
testing photon:3.0
	'no-hard-coded-passwords' [1/1]...cut: /etc/shadow: No such file or directory
warning: garbage password detected for 'nobody': 'x'
warning: garbage password detected for 'systemd-network': 'x'
warning: garbage password detected for 'bin': 'x'
warning: garbage password detected for 'systemd-journal-gateway': 'x'
warning: garbage password detected for 'systemd-journal-remote': 'x'
warning: garbage password detected for 'daemon': 'x'
warning: garbage password detected for 'systemd-bus-proxy': 'x'
warning: garbage password detected for 'messagebus': 'x'
warning: garbage password detected for 'systemd-journal-upload': 'x'
warning: garbage password detected for 'systemd-timesync': 'x'
warning: garbage password detected for 'systemd-resolve': 'x'
error: empty password detected for 'root'
failed
testing photon:dev
	'no-hard-coded-passwords' [1/1]...cut: /etc/shadow: No such file or directory
warning: garbage password detected for 'nobody': 'x'
warning: garbage password detected for 'systemd-network': 'x'
warning: garbage password detected for 'bin': 'x'
warning: garbage password detected for 'systemd-journal-gateway': 'x'
warning: garbage password detected for 'systemd-journal-remote': 'x'
warning: garbage password detected for 'daemon': 'x'
warning: garbage password detected for 'systemd-bus-proxy': 'x'
warning: garbage password detected for 'messagebus': 'x'
warning: garbage password detected for 'systemd-journal-upload': 'x'
warning: garbage password detected for 'systemd-timesync': 'x'
warning: garbage password detected for 'systemd-resolve': 'x'
error: empty password detected for 'root'
failed
testing photon:1.0
	'no-hard-coded-passwords' [1/1]...cut: /etc/shadow: No such file or directory
warning: garbage password detected for 'nobody': 'x'
warning: garbage password detected for 'systemd-network': 'x'
warning: garbage password detected for 'bin': 'x'
warning: garbage password detected for 'systemd-journal-gateway': 'x'
warning: garbage password detected for 'systemd-journal-remote': 'x'
warning: garbage password detected for 'daemon': 'x'
warning: garbage password detected for 'systemd-bus-proxy': 'x'
warning: garbage password detected for 'messagebus': 'x'
warning: garbage password detected for 'systemd-journal-upload': 'x'
warning: garbage password detected for 'systemd-timesync': 'x'
warning: garbage password detected for 'systemd-resolve': 'x'
error: empty password detected for 'root'
failed
testing photon:2.0
	'no-hard-coded-passwords' [1/1]...cut: /etc/shadow: No such file or directory
warning: garbage password detected for 'nobody': 'x'
warning: garbage password detected for 'systemd-network': 'x'
warning: garbage password detected for 'bin': 'x'
warning: garbage password detected for 'systemd-journal-gateway': 'x'
warning: garbage password detected for 'systemd-journal-remote': 'x'
warning: garbage password detected for 'daemon': 'x'
warning: garbage password detected for 'systemd-bus-proxy': 'x'
warning: garbage password detected for 'messagebus': 'x'
warning: garbage password detected for 'systemd-journal-upload': 'x'
warning: garbage password detected for 'systemd-timesync': 'x'
warning: garbage password detected for 'systemd-resolve': 'x'
error: empty password detected for 'root'
failed
testing sl:7
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'root': 'locked'
passed
testing sl:6
	'no-hard-coded-passwords' [1/1]...warning: garbage password detected for 'root': 'locked'
passed
testing sourcemage:latest
	'no-hard-coded-passwords' [1/1]...passed
testing swarm:1.2.9
	image has no tests...skipping
testing traefik:v2.0.0-alpha4
	image has no tests...skipping
testing traefik:v2.0.0-alpha4-alpine
	image has no tests...skipping
testing traefik:v1.7.11
	image has no tests...skipping
testing traefik:v1.7.11-alpine
	image has no tests...skipping
testing ubuntu:18.04
	'no-hard-coded-passwords' [1/1]...passed
testing ubuntu:18.10
	'no-hard-coded-passwords' [1/1]...passed
testing ubuntu:19.04
	'no-hard-coded-passwords' [1/1]...passed
testing ubuntu:14.04
	'no-hard-coded-passwords' [1/1]...passed
testing ubuntu:16.04
	'no-hard-coded-passwords' [1/1]...passed

tianon · 2019-05-08T22:13:55Z

So the list that are affected by this includes:

busybox (I'll take this one): Add simple fix for CVE-2019-5021 (patching Buildroot's file) busybox#60
crux (cc @lag-linaro @odidev @prologic)
opensuse (given Please remove openSUSE from the official library #5371, going away after June 30, 2019 so maybe not worth fixing? cc @Vogtinator)
photon (cc @frapposelli @YustasSwamp @michellew-vmware @gerrit-photon)

tianon · 2019-05-08T22:58:41Z

Anyone feel like sending a patch to the Buildroot mailing list? 😅

https://git.busybox.net/buildroot/tree/system/skeleton/etc/shadow?id=be8d11c7e55d8dfe395774c04a7a35b949aa6d97#n1

(I'll be patching that in busybox either way.)

Edit: FWIW, I dug into the commits and found that this passwordless root user in Buildroot's default skeleton goes all the way back to the initial introduction of the skeleton directory in https://git.busybox.net/buildroot/commit/?id=339f2f492ed524a5eae48e799b2d1349c52473b3 (back in 2001 😅)

Update "empty" password handling in "no-hard-coded-passwords" to balk…

cebaec7

… at an empty root password explicitly (CVE-2019-5021)

tianon mentioned this pull request May 8, 2019

CVE-2019-5021: Fix "DISABLE_ROOT_PASSWD" default value for build "options" files gliderlabs/docker-alpine#511

Open

This was referenced May 8, 2019

Add simple fix for CVE-2019-5021 (patching Buildroot's file) docker-library/busybox#60

Merged

CVE-2019-5021 alpinelinux/docker-alpine#13

Closed

Update BusyBox (especially for CVE-2019-5021) #5885

Merged

yosifkit merged commit 6f65461 into docker-library:master May 9, 2019

yosifkit deleted the CVE-2019-5021 branch May 9, 2019 19:56

yosifkit mentioned this pull request May 13, 2019

Update photon image #5900

Merged

Vogtinator mentioned this pull request May 29, 2019

Update opensuse:42.3 to latest commit #5972

Merged

yosifkit mentioned this pull request Dec 16, 2019

crux: add 3.5 amd64 version, update maintainers #7130

Closed

tianon mentioned this pull request Jun 1, 2021

Eggdrop v1.9.1 *STABLE* #10286

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update "empty" password handling in "no-hard-coded-passwords" to balk at an empty root password explicitly (CVE-2019-5021) #5880

Update "empty" password handling in "no-hard-coded-passwords" to balk at an empty root password explicitly (CVE-2019-5021) #5880

tianon commented May 8, 2019

tianon commented May 8, 2019

yosifkit commented May 8, 2019

yosifkit commented May 8, 2019

tianon commented May 8, 2019

tianon commented May 8, 2019 •

edited

Loading

tianon commented May 8, 2019 •

edited

Loading

Update "empty" password handling in "no-hard-coded-passwords" to balk at an empty root password explicitly (CVE-2019-5021) #5880

Update "empty" password handling in "no-hard-coded-passwords" to balk at an empty root password explicitly (CVE-2019-5021) #5880

Conversation

tianon commented May 8, 2019

tianon commented May 8, 2019

yosifkit commented May 8, 2019

yosifkit commented May 8, 2019

tianon commented May 8, 2019

tianon commented May 8, 2019 • edited Loading

tianon commented May 8, 2019 • edited Loading

tianon commented May 8, 2019 •

edited

Loading

tianon commented May 8, 2019 •

edited

Loading