CVE-2020-35187: 
NixOS vulnerability analysis and mitigation

The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. This vulnerability affects all Alpine-specific versions from 0.13.0-alpine through 1.9.4-alpine. The issue was discovered and disclosed in December 2020 (NVD).

The vulnerability exists in the configuration of the /etc/shadow file within the Docker container, where the root user account was configured with an empty password. This security misconfiguration has been assigned a CVSS v3.1 base score of 9.8 CRITICAL with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is classified under CWE-306 (Missing Authentication for Critical Function) (NVD).

The vulnerability can lead to multiple severe security impacts including unauthorized code execution, denial of service, privilege escalation, and information disclosure. Systems using the telegraf docker container deployed by affected versions may allow a remote attacker to achieve root access with a blank password (CISA).

The vulnerability can be exploited remotely by an attacker without requiring any special privileges or user interaction. The attack vector is through the telegraf docker image, where an attacker can gain root access by exploiting the blank password configuration (NVD).

Users should upgrade to telegraf docker image version 1.9.4-alpine or later to address this vulnerability. The fix involves proper password configuration for the root user in the Alpine-based container images (Docker Hub).