Bug 1680165 (CVE-2019-0816)

Summary:	CVE-2019-0816 cloud-init: extra ssh keys added to authorized_keys on the Azure platform
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:	Yuxin Sun <yuxisun>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, adimania, ailan, apevec, cbuissar, dbaker, eterrell, gholms, jgreguske, jokerman, lars, leiwang, lpardo, mrezanin, pmatouse, ribarry, security-response-team, shardy, s, sthangav, trankin, virt-maint, wshi, yuxisun
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cloud-init 19.1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-03-19 08:32:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1684038, 1684040, 1686578, 1688366, 1688367, 1714749, 1714767
Bug Blocks:	1680169

Description Laura Pardo 2019-02-22 21:27:28 UTC

A vulnerability was found in the Azure plugin of cloud-init. The entire list of certificates and public keys exposed from the wireserver is added to the authorized_keys file for the user-to-be-provisioned, regardless of whether they belong to the user or not.


Upstream commit:
https://code.launchpad.net/~jasonzio/cloud-init/+git/cloud-init/+merge/363445

Comment 16 Cedric Buissart 2019-03-07 18:10:25 UTC

External References:

https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm

Comment 18 Cedric Buissart 2019-03-08 09:05:58 UTC

Mitigation:

See steps from https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm

Comment 20 Cedric Buissart 2019-03-13 15:46:28 UTC

Created cloud-init tracking bugs for this issue:

Affects: epel-6 [bug 1688367]
Affects: fedora-all [bug 1688366]

Comment 21 errata-xmlrpc 2019-03-18 18:33:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0597 https://access.redhat.com/errata/RHSA-2019:0597