Vulnerabilities > CVE-2018-10896 - Unspecified vulnerability in Canonical Cloud-Init

CVSS 7.1 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

local

low complexity

canonical

NVD

Published: 2018-08-01

Updated: 2024-11-21

Summary

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.

Vulnerable Configurations

Part	Description	Count
Application	Canonical Canonical Cloud Init 0.6.2 Canonical Cloud Init 0.6.3 Canonical Cloud Init 0.7.0 Canonical Cloud Init 0.7.1 Canonical Cloud Init 0.7.2 Canonical Cloud Init 0.7.3 Canonical Cloud Init 0.7.4 Canonical Cloud Init 0.7.5 Canonical Cloud Init 0.7.6 Canonical Cloud Init 0.7.7 Canonical Cloud Init 0.7.8 Canonical Cloud Init 0.7.9 Canonical Cloud Init 17.1 Canonical Cloud Init 17.2 Canonical Cloud Init 18.1 Canonical Cloud Init 18.2 Canonical Cloud Init 18.3	17

Summary

Vulnerable Configurations

References