Amazon Linux 2 Security Advisory: ALAS-2021-1576
Advisory Release Date: 2021-01-05 23:34 Pacific
Advisory Updated Date: 2021-01-06 20:23 Pacific
FAQs regarding Amazon Linux ALAS/CVE Severity
The default cloud-init configuration included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks. (CVE-2018-10896)
A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random strings used for generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the victim user. (CVE-2020-8631)
A flaw was found in cloud-init, where it uses short passwords when generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the victim user. (CVE-2020-8632)
Affected Packages:
cloud-init
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update cloud-init to update your system.
noarch:
cloud-init-19.3-4.amzn2.noarch
src:
cloud-init-19.3-4.amzn2.src