CVE-2022-29186

{"id": "CVE-2022-29186", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2022-05-20T21:15:10.177", "references": [{"url": "https://github.com/rundeck/rundeck/commit/16ef7a70b202492f9fbb54d8af4bb8ea0afa10ad", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rundeck/rundeck/security/advisories/GHSA-qxjx-xr2m-hgqx", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized_keys files on remote host, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances of PagerDuty\u00ae Process Automation On Prem (formerly Rundeck) version 4.0 and earlier, not Debian, RPM or .WAR. Additionally, the id_rsa.pub file would have to be copied from the Docker image filesystem contents without overwriting it and used to configure SSH access on a host. A patch on Rundeck's `main` branch has removed the pre-generated SSH key pair, but it does not remove exposed keys that have been configured. To patch, users must run a script on hosts in their environment to search for exposed keys and rotate them. Two workarounds are available: Do not use any pre-existing public key file from the rundeck docker images to allow SSH access by adding it to authorized_keys files and, if you have copied the public key file included in the docker image, remove it from any authorized_keys files."}, {"lang": "es", "value": "Rundeck es un servicio de automatizaci\u00f3n de c\u00f3digo abierto con una consola web, herramientas de l\u00ednea de comandos y una WebAPI. Las im\u00e1genes docker de Rundeck community y rundeck-enterprise contienen un par de claves SSH pregeneradas. Si la clave p\u00fablica id_rsa.pub del par de claves es copiada en los archivos authorized_keys de los hosts remotos, \u00e9stos permitir\u00edan el acceso a cualquier persona con las credenciales privadas expuestas. Esta configuraci\u00f3n err\u00f3nea s\u00f3lo afecta a instancias de Rundeck Docker de PagerDuty\u00c2\u00ae Process Automation On Prem (anteriormente Rundeck) versi\u00f3n 4.0 y anteriores, no a Debian, RPM o .WAR. Adem\u00e1s, el archivo id_rsa.pub tendr\u00e1 que copiarse del contenido del sistema de archivos de la imagen Docker sin sobrescribirlo y usarse para configurar el acceso SSH en un host. Un parche en la rama \"main\" de Rundeck ha eliminado el par de claves SSH pregeneradas, pero no elimina las claves expuestas que han sido configuradas. Para aplicar el parche, los usuarios deben ejecutar un script en los hosts de su entorno para buscar las claves expuestas y rotarlas. Se presentan dos mitigaciones disponibles: No usar ning\u00fan archivo de clave p\u00fablica preexistente de las im\u00e1genes docker rundeck para permitir el acceso SSH al a\u00f1adirlo a los archivos authorized_keys y, si ha sido copiado el archivo de clave p\u00fablica incluido en la imagen docker, eliminarlo de cualquier archivo authorized_keys"}], "lastModified": "2023-11-07T03:45:57.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pagerduty:rundeck:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "FE7E719F-C5A2-4847-B9C0-49BD9CA18BC1", "versionEndExcluding": "4.1.0"}, {"criteria": "cpe:2.3:a:pagerduty:rundeck:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "99DACACF-DA46-452F-96D4-24975FC9F54B", "versionEndExcluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}