Alerts This Week
Warning Icon 1 609
Alerts This Week
Warning Icon 1 609

SUSE: 2019:3191-1 Moderate Severity: Cloud-Init SSH Key Vulnerability

suse
Calendar Grey December 5, 2019
Dist Suse Esm H88
The SUSE Security Update addresses vulnerabilities found in cloud-init and implements multiple patches to improve overall software security integrity.
An update that solves one vulnerability and has 6 fixes is now available

Summary

This update for cloud-init fixes the following issues: Security issue fixed: - CVE-2019-0816: Fixed the unnecessary extra ssh keys that were added to authorized_keys (bsc#1129124). Non-security issues fixed: - Add cloud-init-renderer-detect.patch (bsc#1154092, bsc#1142988) + Short curcuit the conditional for identifying the sysconfig renderer. If we find ifup/ifdown accept the renderer as available. - Add cloud-init-break-resolv-symlink.patch (bsc#1151488) + If /etc/resolv.conf is a symlink break it. This will avoid netconfig from clobbering the changes cloud-init applied. - Update to cloud-init 19.2 (bsc#1099358) + Remove, included upstream - cloud-init-detect-nova.diff - cloud-init-add-static-routes.diff + net: add rfc3442 (classless static routes) to EphemeralDHCP (LP: #1821102)

References

#1099358 #1129124 #1136440 #1142988 #1144363

#1151488 #1154092

Cross- CVE-2019-0816

Affected Products:

SUSE Linux Enterprise Module for Public Cloud 12

SUSE CaaS Platform 3.0

https://www.suse.com/security/cve/CVE-2019-0816.html

https://bugzilla.suse.com/1099358

https://bugzilla.suse.com/1129124

https://bugzilla.suse.com/1136440

https://bugzilla.suse.com/1142988

https://bugzilla.suse.com/1144363

https://bugzilla.suse.com/1151488

https://bugzilla.suse.com/1154092

Announcement ID: SUSE-SU-2019:3191-1
Rating: moderate

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here