Red Hat Security Advisory: cloud-init security, bug fix, and enhancement update

Fixed packages 1

Vulnerabilities 3

• Medium 4.6
  CVE-2018-10896

  The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init…

  Canonical cloud-init
  Aug 1, 2018
• Unscored —
  CVE-2020-8631

  cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predic…

  cloud-init cloud-init Debian Ubuntu
  Feb 5, 2020
• Unscored —
  CVE-2020-8632

  In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value,…

  cloud-init cloud-init Debian Ubuntu
  Feb 5, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1574338
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1598831
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1748015
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772505
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1793652
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1798728
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1798731
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1803094
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1821679
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1821999
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3898.json
• report
  https://access.redhat.com/security/cve/CVE-2018-10896
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10896
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10896
• report
  https://access.redhat.com/security/cve/CVE-2020-8631
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8631
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8631
• report
  https://access.redhat.com/security/cve/CVE-2020-8632
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8632
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8632