cloud-init-19.4-1.el8.7
エラータID: AXSA:2020-635:05
リリース日:
2020/10/08 Thursday - 05:08
題名:
cloud-init-19.4-1.el8.7
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- cloud-initには、SSHホストキーの削除を無効にする
"ssh_deletekeys: 0"の設定が標準となっているため、
ゴールデンマスターやシステムテンプレートからSSHホストキーが
同一のインスタンスを生成し、他者へのなりすましや中間者攻撃を
可能にしてしまう脆弱性があります。(CVE-2018-10896)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2018-10896
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
追加情報:
N/A
ダウンロード:
SRPMS
- cloud-init-19.4-1.el8.7.src.rpm
MD5: 42953f0d67a6710c36fb86c8334f99e4
SHA-256: fffd5d3f098c09ee5f5255a9c99d0f0ca2d84aff215ee2667bb99a8164e334e0
Size: 1.09 MB
Asianux Server 8 for x86_64
- cloud-init-19.4-1.el8.7.noarch.rpm
MD5: 8749aa861d4d6ad2a0268d30edeb2932
SHA-256: 3a90e189cf4afc145f5988ca0f14c9f61456bdc3faae436e749e1f0a1354a2ac
Size: 928.98 kB
English