Description
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | cloud-init | 0.6.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | cloud-init | 19.4-1.el8.7 | RHSA-2020:3050 |
| RHEL 7 | cloud-init | 19.4-7.el7 | RHSA-2020:3898 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.2 EUS | cloud-init | 18.5-12.el8_2.3 | RHSA-2020:3644 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | cloud-init | 19.3-4.amzn2 | ALAS2-2021-1576 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | cloud-init | 19.4-7.0.3.el7 | ELSA-2020-3898 |
Advisories 5
- RHSA-2020:3898 Red Hat Security Advisory: cloud-init security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2020:3644 Red Hat Security Advisory: cloud-init security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2020:3050 Red Hat Security Advisory: cloud-init security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- ALAS2-2021-1576 Moderate: cloud-init security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 6, 2021
- ELSA-2020-3898 Moderate: cloud-init security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 6, 2020