CVE-2018-10896

CWE-3218 documents6 sources
Severity
7.1HIGH
EPSS
0.1%
top 70.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Canonical Cloud-init
Timeline
PublishedAug 1
Latest updateMay 13

Description

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 1.8 | Impact: 5.2

Affected Packages2 packages

▶NVDcanonical/cloud-init0.6.2 — 18.4
▶CVEListV5canonical/cloud-init0.6.2

Patches

Patch: bugs.launchpad.net ↗Patch: bugzilla.redhat.com ↗Patch: bugs.launchpad.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-rwhw-r234-9p3m: The default cloud-init configuration, in cloud-init 0↗2022-05-13
▶
CVEList
CVE-2018-10896: The default cloud-init configuration, in cloud-init 0↗2018-08-01
▶

📋Vendor Advisories

2
Microsoft
The default cloud-init configuration in cloud-init 0.6.2 and newer included "ssh_deletekeys: 0" disabling cloud-init's deletion of ssh host keys. In some environments this could lead to instances crea↗2018-08-14
▶
Red Hat
cloud-init: default configuration disabled deletion of SSH host keys↗2018-07-06
▶

💬Community

3
Bugzilla
CVE-2018-10896 cloud-init: default configuration disabled deletion of SSH host keys [fedora-all]↗2018-07-06
▶
Bugzilla
CVE-2018-10896 cloud-init: default configuration disabled deletion of SSH host keys [epel-6]↗2018-07-06
▶
Bugzilla
CVE-2018-10896 cloud-init: default configuration disabled deletion of SSH host keys↗2018-07-06
▶
CVE-2018-10896 (HIGH CVSS 7.1) | The default cloud-init configuratio | cvebase.io