A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has cloud-init packages installed that are affected by multiple vulnerabilities:

  - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included ssh_deletekeys: 0,     disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances     created by cloning a golden master or template system, sharing ssh host keys, and being able to     impersonate one another or conduct man-in-the-middle attacks. (CVE-2018-10896)

  - A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some     Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.
    (CVE-2019-0816)

  - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for     attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
    (CVE-2020-8631)

  - In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default     pwlen value, which makes it easier for attackers to guess passwords. (CVE-2020-8632)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has cloud-init packages installed that are affected by a vulnerability:

  - A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some     Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.
    (CVE-2019-0816)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote host is prior to 19.3-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1595 advisory.

  - A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some     Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.
    (CVE-2019-0816)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A security feature bypass exists in Azure SSH Keypairs,     due to a change in the provisioning logic for some     Linux images that use cloud-init, aka 'Azure SSH     Keypairs Security Feature Bypass     Vulnerability'.(CVE-2019-0816)

  - cloud-init through 19.4 relies on Mersenne Twister for     a random password, which makes it easier for attackers     to predict passwords, because rand_str in     cloudinit/util.py calls the random.choice     function.(CVE-2020-8631)

  - In cloud-init through 19.4, rand_user_password in     cloudinit/config/cc_set_passwords.py has a small     default pwlen value, which makes it easier for     attackers to guess passwords.(CVE-2020-8632)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cloud-init package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Cloud-init is a set of init scripts for cloud     instances. Cloud instances need special scripts to run     during initialization to retrieve and install ssh keys     and to let the user run various scripts.Security     Fix(es):cloud-init through 19.4 relies on Mersenne     Twister for a random password, which makes it easier     for attackers to predict passwords, because rand_str in     cloudinit/util.py calls the random.choice     function.(CVE-2020-8631)A security feature bypass     exists in Azure SSH Keypairs, due to a change in the     provisioning logic for some Linux images that use     cloud-init, aka 'Azure SSH Keypairs Security Feature     Bypass Vulnerability'.(CVE-2019-0816)In cloud-init     through 19.4, rand_user_password in     cloudinit/config/cc_set_passwords.py has a small     default pwlen value, which makes it easier for     attackers to guess passwords.(CVE-2020-8632)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cloud-init to version 19.2 fixes the following issues :

Security issue fixed :

  - CVE-2019-0816: Fixed the unnecessary extra ssh keys that     were added to authorized_keys (bsc#1129124).

Non-security issues fixed :

  - Short circuit the conditional for identifying the     sysconfig renderer (bsc#1154092, bsc#1142988).

  - If /etc/resolv.conf is a symlink, break it. This will     avoid netconfig from clobbering the changes cloud-init     applied (bsc#1151488).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for cloud-init to version 19.2 fixes the following issues :

Security issue fixed :

  - CVE-2019-0816: Fixed the unnecessary extra ssh keys that     were added to authorized_keys (bsc#1129124).

Non-security issues fixed :

  - Short circuit the conditional for identifying the     sysconfig renderer (bsc#1154092, bsc#1142988).

  - If /etc/resolv.conf is a symlink, break it. This will     avoid netconfig from clobbering the changes cloud-init     applied (bsc#1151488).

This update was imported from the SUSE:SLE-15:Update update project.

This update for cloud-init to version 19.2 fixes the following issues :

Security issue fixed :

CVE-2019-0816: Fixed the unnecessary extra ssh keys that were added to authorized_keys (bsc#1129124).

Non-security issues fixed: Short circuit the conditional for identifying the sysconfig renderer (bsc#1154092, bsc#1142988).

If /etc/resolv.conf is a symlink, break it. This will avoid netconfig from clobbering the changes cloud-init applied (bsc#1151488).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A security feature bypass exists in Azure SSH Keypairs,     due to a change in the provisioning logic for some     Linux images that use cloud-init, aka 'Azure SSH     Keypairs Security Feature Bypass     Vulnerability'.(CVE-2019-0816)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - cloud-init: extra ssh keys added to authorized_keys on     the Azure platform (CVE-2019-0816)

An update for cloud-init is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.

Security Fix(es) :

* cloud-init: extra ssh keys added to authorized_keys on the Azure platform (CVE-2019-0816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:0597 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: extra ssh keys added to authorized_keys on the Azure platform (CVE-2019-0816)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2019-0597 advisory.

    [18.2-1.0.1]
    - add modified version of enable-ec2_utils-to-stop-retrying-to-get-ec2-metadata.patch for 18.2:
      1. Enable ec2_utils.py having a way to stop retrying to get ec2 metadata       2. Apply stop retrying to get ec2 metadata to helper/openstack.py MetadataReader       Resolves: Oracle-Bug:41660 (Bugzilla)

    [18.2-1.el7_6.2]
    - ci-azure-Filter-list-of-ssh-keys-pulled-from-fabric.patch [bz#1684038]
    - Resolves: bz#1684038       (EMBARGOED cloud-init: wrong list of ssh keys added to authorized_keys [rhel-7.6.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
154516	NewStart CGSL CORE 5.05 / MAIN 5.05 : cloud-init Multiple Vulnerabilities (NS-SA-2021-0151)	Nessus	NewStart CGSL Local Security Checks	high
147287	NewStart CGSL CORE 5.04 / MAIN 5.04 : cloud-init Vulnerability (NS-SA-2021-0011)	Nessus	NewStart CGSL Local Security Checks	medium
146630	Amazon Linux 2 : cloud-init (ALAS-2021-1595)	Nessus	Amazon Linux Local Security Checks	medium
137970	EulerOS Virtualization 3.0.6.0 : cloud-init (EulerOS-SA-2020-1751)	Nessus	Huawei Local Security Checks	medium
136222	EulerOS Virtualization for ARM 64 3.0.2.0 : cloud-init (EulerOS-SA-2020-1519)	Nessus	Huawei Local Security Checks	medium
131693	openSUSE Security Update : cloud-init (openSUSE-2019-2633)	Nessus	SuSE Local Security Checks	medium
131687	openSUSE Security Update : cloud-init (openSUSE-2019-2621)	Nessus	SuSE Local Security Checks	medium
131558	SUSE SLED15 / SLES15 Security Update : cloud-init (SUSE-SU-2019:3097-1)	Nessus	SuSE Local Security Checks	medium
131557	SUSE SLED15 / SLES15 Security Update : cloud-init (SUSE-SU-2019:3096-1)	Nessus	SuSE Local Security Checks	medium
130841	EulerOS 2.0 SP5 : cloud-init (EulerOS-SA-2019-2132)	Nessus	Huawei Local Security Checks	medium
122962	Scientific Linux Security Update : tomcat on SL7.x (x86_64) (20190318)	Nessus	Scientific Linux Local Security Checks	medium
122961	Scientific Linux Security Update : cloud-init on SL7.x (x86_64) (20190318)	Nessus	Scientific Linux Local Security Checks	medium
122955	CentOS 7 : cloud-init (CESA-2019:0597)	Nessus	CentOS Local Security Checks	medium
122939	RHEL 7 : cloud-init (RHSA-2019:0597)	Nessus	Red Hat Local Security Checks	medium
122938	Oracle Linux 7 : cloud-init (ELSA-2019-0597)	Nessus	Oracle Linux Local Security Checks	medium

Detections

Analytics

CVE-2019-0816

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium