A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade cloud-init | Feb 22, 2021 | Apr 9, 2019 |
| Centos_linux | — | Upgrade cloud-init | Apr 1, 2019 | Mar 19, 2019 |
| Debian | — | Upgrade cloud-init | Jul 30, 2024 | Apr 9, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade cloud-init | Nov 19, 2019 | Apr 9, 2019 |
| Oracle_linux | — | Upgrade cloud-init | Jul 21, 2020 | Mar 5, 2019 |
| Redhat_linux | — | Upgrade cloud-init | Mar 19, 2019 | Mar 18, 2019 |
| Suse | — | Upgrade cloud-init-docUpgrade cloud-initUpgrade cloud-init-config-suse | Dec 4, 2019 | Mar 19, 2019 |
| Ubuntu | — | Upgrade cloud-init | Nov 19, 2024 | Apr 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub