CVE-2018-10896

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-321

Affected software

Vendor	Product	Versions
Canonical	cloud-init	0.6.2

References

https://bugs.launchpad.net/cloud-init/+bug/1781094Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1574338Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10896Issue Tracking, Patch, Third Party Advisory
https://bugs.launchpad.net/cloud-init/+bug/1781094Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1574338Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10896Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Aug 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-108978.1A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configur CVE-2018-108988.8A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configurat CVE-2018-108998.8A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for p CVE-2018-10907.5In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with rea CVE-2018-109007.8Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line charac CVE-2018-109017.8A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but CVE-2018-109027.8It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd CVE-2018-109037.5A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. I CVE-2018-109048.8It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by CVE-2018-109057.8CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with acc CVE-2018-109067.8In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non CVE-2018-109078.8It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating f