cloud-init-19.4-7.el7
エラータID: AXSA:2020-607:04
リリース日:
2020/10/07 Wednesday - 04:56
題名:
cloud-init-19.4-7.el7
影響のあるチャネル:
Asianux Server 7 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- cloud-initには、SSHホストキーの削除を無効にする
"ssh_deletekeys: 0"の設定が標準となっているため、
ゴールデンマスターやシステムテンプレートからSSHホストキーが
同一のインスタンスを生成し、他者へのなりすましや中間者攻撃を
可能にしてしまう脆弱性があります。(CVE-2018-10896)
- cloud-initのcloudinit/util.pyのrand_str関数には、
擬似乱数発生器を用いたrandom.choice関数を呼び出しているため、
攻撃者がパスワードを予測することを容易にしてしまう脆弱性が
あります。(CVE-2020-8631)
- cloud-init の cloudinit/config/cc_set_passwords.py
で定義される rand_user_password() 関数 には、この関数が
生成するパスワード長の既定値が小さいため、攻撃者にとって
推測を容易にしている脆弱性があります。(CVE-2020-8632)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2018-10896
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
CVE-2020-8631
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
CVE-2020-8632
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.
追加情報:
N/A
ダウンロード:
SRPMS
- cloud-init-19.4-7.el7.src.rpm
MD5: 11dc7c6f965e35c9400321b50b7669c1
SHA-256: bbc010b9f30a07b9f8b309787d8d8bf82fb4dc7fb12b4498d7add58c9615084d
Size: 1.09 MB
Asianux Server 7 for x86_64
- cloud-init-19.4-7.el7.x86_64.rpm
MD5: c5190cc595d5f1efd27c2d708d8d1d7e
SHA-256: ed10441ce5b8d81330ffc5da489ea0416df3456516853da3748014246cbf7dde
Size: 929.46 kB
English