| Name | CVE-2019-0816 |
| Description | A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 926043 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| cloud-init (PTS) | jessie, jessie (lts) | 0.7.6~bzr976-2+deb8u3 | fixed |
| stretch (security), stretch (lts), stretch | 0.7.9-2+deb9u1 | vulnerable |
| buster | 20.2-2~deb10u2 | fixed |
| bullseye | 20.4.1-2+deb11u1 | fixed |
| bookworm | 22.4.2-1 | fixed |
| trixie | 24.1.1-1 | fixed |
| sid | 24.1.4-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| cloud-init | source | jessie | (not affected) | | | |
| cloud-init | source | (unstable) | 18.3-6 | low | | 926043 |
Notes
[stretch] - cloud-init <no-dsa> (Doesn't affect default provisioning for Azure, only limited use cases)
[jessie] - cloud-init <not-affected> (version uses a different mechanism to set public keys.)
https://code.launchpad.net/~jasonzio/cloud-init/+git/cloud-init/+merge/363445
https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm