The default cloud-init configuration, in cloud-init 0.6.2 and newer, included ssh_deletekeys: 0, disabling cloud-inits deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cloud-init | Canonical | 0.6.2 (including) | 18.4 (excluding) |
| Red Hat Enterprise Linux 7 | RedHat | cloud-init-0:19.4-7.el7 | * |
| Red Hat Enterprise Linux 8 | RedHat | cloud-init-0:19.4-1.el8.7 | * |
| Red Hat Enterprise Linux 8.2 Extended Update Support | RedHat | cloud-init-0:18.5-12.el8_2.3 | * |