CVE-2020-35186: 
NixOS vulnerability analysis and mitigation

The official adminer docker images before version 4.7.0-fastcgi contained a critical security vulnerability where the root user account was configured with a blank password. This vulnerability was discovered and disclosed in December 2020, affecting all versions from 4.2.5-fastcgi through versions prior to 4.7.0-fastcgi. The vulnerability impacts systems using the adminer docker container deployed with affected versions (Docker Hub).

The vulnerability stems from a misconfiguration in the /etc/shadow file where the root user account was set up with an empty password. This security oversight affects the container's authentication mechanism, allowing unrestricted root access. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating the highest severity level (NVD).

The vulnerability's impact is severe as it allows remote attackers to gain root access to the container without requiring any password authentication. This compromises all key security aspects: confidentiality, integrity, and availability. An attacker who gains root access would have complete control over the container, potentially leading to data breaches, service disruptions, and system compromises (CISA).

The vulnerability is highly exploitable as it requires no special privileges or complex attack vectors. Any remote attacker who can access the container can potentially gain root access by simply logging in with the root username and an empty password. The attack requires no user interaction and can be executed with low complexity (NVD).

The primary mitigation is to upgrade to adminer docker image version 4.7.0-fastcgi or later, which addresses this vulnerability. Organizations using affected versions should immediately update their container images to the patched version. As a temporary workaround, organizations should restrict network access to the container and implement additional authentication layers if immediate upgrading is not possible (Docker Hub).