Published: 01/08/2018 Updated: 13/02/2023

CVSS v2 Base Score: 3.6 | Impact Score: 4.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.1 | Impact Score: 5.2 | Exploitability Score: 1.8

VMScore: 320

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical cloud-init

Synopsis Low: cloud-init security, bug fix, and enhancement update Type/Severity Security Advisory: Low Topic An update for cloud-init is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVS ...

Synopsis Moderate: cloud-init security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for cloud-init is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scor ...

Synopsis Low: cloud-init security update Type/Severity Security Advisory: Low Topic An update for cloud-init is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVS ...

The default cloud-init configuration included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks (CVE-2018-10896) A flaw ...

The default cloud-init configuration included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks ...

CWE-321 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10896 https://bugzilla.redhat.com/show_bug.cgi?id=1574338 https://bugs.launchpad.net/cloud-init/+bug/1781094 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2020:3050 https://alas.aws.amazon.com/AL2/ALAS-2021-1576.html https://access.redhat.com/security/cve/cve-2018-10896

CVE-2018-10896

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect