Skip to content

Close security hole for root #21

@jeremydouglass

Description

@jeremydouglass

This package was identified by a security researcher as being a popular package and having a potential security vulnerability related to the recent Alpine CVE-2019-5021.

https://www.kennasecurity.com/20-of-the-1000-most-popular-docker-containers-have-no-root-password/

News discussion here:

https://www.zdnet.com/article/root-account-misconfigurations-found-in-20-of-top-1000-docker-containers/

The proposed fix is adding this line to the Dockerfile:

# make sure root login is disabled
RUN sed -i -e 's/^root::/root:!:/' /etc/shadow

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions