Azure SSH Keypairs Security Feature Bypass Vulnerability
CVE-2019-0816 is fixed in 2 products on 2 platforms, first by KB4491476, released March 12, 2019. It is not reported as exploited. Patch Radar priority: Routine.
<p>A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init. Extraneous Microsoft service public keys can be unexpectedly added to the VM authorized keys file in the limited scenarios described in <a href="https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm">4491476</a>. For more information on how to know if you are affected and how to protect yourself, please see <a href="https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm">4491476</a>.</p> <p>This update addresses this vulnerability by preventing these keys from being added.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Microsoft | |||
| UbuntuServer:18.04-LTS | KB4491476 | Mar 12, 2019 | |
| Linux | |||
| cloud-init · RHEL 8 | 0:18.5-1.el8.4 | RHBA-2019:1992 | Jul 30, 2019 |
| cloud-init · Ubuntu 18.04.6 LTS (bionic) | 18.5-45-g3554ffe8-0ubuntu1~18.04.1 | cloud-init 18.5-45-g3554ffe8-0ubuntu1~18.04.1 | Apr 8, 2019 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.