ALAS2-2021-1576


Amazon Linux 2 Security Advisory: ALAS-2021-1576
Advisory Release Date: 2021-01-05 23:34 Pacific
Advisory Updated Date: 2021-01-06 20:23 Pacific
Severity: Medium

Issue Overview:

The default cloud-init configuration included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks. (CVE-2018-10896)

A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random strings used for generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the victim user. (CVE-2020-8631)

A flaw was found in cloud-init, where it uses short passwords when generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the victim user. (CVE-2020-8632)


Affected Packages:

cloud-init


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update cloud-init to update your system.

New Packages:
noarch:
    cloud-init-19.3-4.amzn2.noarch

src:
    cloud-init-19.3-4.amzn2.src