CVE-2018-10896: High severity cloud-init vulnerability
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "sshdeletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-10896?
CVE-2018-10896 is a vulnerability in the default cloud-init configuration that disables cloud-init's deletion of ssh host keys, potentially leading to sharing of ssh host keys between instances.
What is the severity of CVE-2018-10896?
CVE-2018-10896 has a severity rating of 7.1 (high).
How does CVE-2018-10896 affect cloud-init?
CVE-2018-10896 affects cloud-init versions 0.6.2 and newer by disabling the deletion of ssh host keys in the default configuration.
How can I fix CVE-2018-10896?
To fix CVE-2018-10896, update cloud-init to a version newer than 0.6.2 and ensure that ssh_deletekeys is not set to 0 in the cloud-init configuration.
Where can I find more information about CVE-2018-10896?
You can find more information about CVE-2018-10896 at the following references: [1] [2] [3]