PT-2020-17202 · Docker · Express Gateway

Koharin · Published 2020-12-08 · Updated 2020-12-22 · CVE-2020-29579

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Express Gateway versions prior to 1.14.0

Description The official Express Gateway Docker images contain a blank password for a root user, which may allow a remote attacker to achieve root access. This issue affects systems using the Express Gateway Docker container deployed by affected versions of the Docker image.

Recommendations For versions prior to 1.14.0, update to version 1.14.0 or later to resolve the issue. As a temporary workaround, consider disabling root access to the container until a patch is applied. Restrict access to the container to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2020-29579

Affected Products

Express Gateway

References · 5

• 🔥 https://github.com/koharin/koharin2/blob/main/CVE-2020-29579 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-29579 · Security Note
• https://osv.dev/vulnerability/CVE-2020-29579 · Vendor Advisory
• https://t.me/cvenotify/6836 · Telegram Post
• https://t.me/cibsecurity/17245 · Telegram Post