CVE-2018-10896 Misconfiguration in cloud-init

Medium 4.6 Published 1 Aug 2018 Updated 5 Aug 2024

Default cloud-init settings disable SSH key deletion, allowing cloned instances to share keys and enabling man-in-the-middle attacks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-10896?

CVE-2018-10896 is a medium-severity vulnerability in Canonical cloud-init, published on 1 Aug 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.

Weakness: CWE-321

Which versions are affected by CVE-2018-10896?

It affects 1 product.

Linux distribution packages (2)

`cloud-init` Red Hat:enterprise_linux:8::appstream	All versions	`0:19.4-1.el8.7`
`cloud-init` Red Hat:rhel_eus:8.2::appstream	All versions	`0:18.5-12.el8_2.3`

Products include Canonical Cloud-Init.

How do I fix CVE-2018-10896?

Change a configuration setting.

Is CVE-2018-10896 being exploited?

There is no known exploitation of CVE-2018-10896 in the wild and no public exploit code.

Sources

Also known as GHSA-rwhw-r234-9p3m, RHSA-2020:3050, RHSA-2020:3644.