CVE-2022-29186
- Source
- https://cve.org/CVERecord?id=CVE-2022-29186
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29186.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-29186
- Aliases
-
- GHSA-qxjx-xr2m-hgqx
- Published
- 2022-05-20T20:20:11Z
- Modified
- 2026-08-12T03:51:35Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise
- Details
-
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized_keys files on remote host, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances of PagerDuty® Process Automation On Prem (formerly Rundeck) version 4.0 and earlier, not Debian, RPM or .WAR. Additionally, the id_rsa.pub file would have to be copied from the Docker image filesystem contents without overwriting it and used to configure SSH access on a host. A patch on Rundeck's
mainbranch has removed the pre-generated SSH key pair, but it does not remove exposed keys that have been configured. To patch, users must run a script on hosts in their environment to search for exposed keys and rotate them. Two workarounds are available: Do not use any pre-existing public key file from the rundeck docker images to allow SSH access by adding it to authorized_keys files and, if you have copied the public key file included in the docker image, remove it from any authorized_keys files. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-321" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29186.json" }- References
Affected packages
Git / github.com/rundeck/rundeck
Affected ranges
- Type
- GIT
- Repo
- https://github.com/rundeck/rundeck
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:pagerduty:rundeck:*:*:*:*:community:*:*:*", "cpe:2.3:a:pagerduty:rundeck:*:*:*:*:enterprise:*:*:*" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "4.1.0" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }