PT-2018-10167 · Canonical+3 · Cloud-Init+3

Laura Pardo · Publicado 2018-07-06 · Atualizado 2023-02-13 · CVE-2018-10896

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions cloud-init versions 0.6.2 and newer

Description The default cloud-init configuration in affected versions includes "ssh deletekeys: 0", which disables the deletion of ssh host keys. This could lead to instances created by cloning a golden master or template system sharing ssh host keys, allowing them to impersonate one another or conduct man-in-the-middle attacks.

Recommendations For cloud-init versions 0.6.2 and newer, consider changing the default cloud-init configuration to enable the deletion of ssh host keys by setting "ssh deletekeys: 1" to prevent instances from sharing ssh host keys.

Correção

Enumeração de Fraquezas

CWE-321

Identificadores relacionados

ALT-PU-2018-2836

CESA-2020_3050

CESA-2020_3898

CVE-2018-10896

RHSA-2020:3050

RHSA-2020:3644

RHSA-2020:3898

RHSA-2020_3050

RHSA-2020_3898

Produtos afetados

Alt Linux

Centos

Red Hat

Cloud-Init

Referências · 21

• https://osv.dev/vulnerability/CVE-2018-10896 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-cr-announce/2020-October/032736.html · Nota
• https://bugs.launchpad.net/cloud-init/+bug/1781094 · Correção
• https://access.redhat.com/errata/RHSA-2020:3898 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2020-October/026046.html · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10896 · Correção
• https://lists.centos.org/pipermail/centos-cr-announce/2020-October/012666.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8631 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2018-2836 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2020-8631 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-10896 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1574338 · Nota
• https://access.redhat.com/security/cve/CVE-2018-10896 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10896 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2018-10896 · Nota