CVE-2025-32755

In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH...

CVE-2025-32755

In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH...

CVE-2025-32754

In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SS...

CVE-2025-32754

CVE-2025-32754 affects the jenkins/ssh-agent Docker images (6.11.1 and earlier). The root cause is that SSH host keys are generated on image creation, causing all containers built from the same image version to share the same host keys. This enables an attacker who can position themselves in the ...

PT-2025-15974 · Unknown +1 · Jenkins/Ssh-Slave +1

Name of the Vulnerable Software and Affected Versions: Jenkins/ssh-slave Docker images based on Debian affected versions not specified Description: The issue arises from SSH host keys being generated on image creation for Jenkins/ssh-slave Docker images based on Debian. This results in all...

PT-2025-15973 · Jenkins · Jenkins/Ssh-Agent +1

Name of the Vulnerable Software and Affected Versions: jenkins/ssh-agent Docker images versions 6.11.1 and earlier Description: The issue arises from SSH host keys being generated on image creation for images based on Debian, causing all containers based on images of the same version to use the...

RHEL 6 : cloud-init (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - cloud-init: default configuration disabled deletion of SSH host keys CVE-2018-10896 Note that Nessus has not tested...

RHEL 6 : cloud-init (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - cloud-init: default configuration disabled deletion of SSH host keys CVE-2018-10896 - cloud-init through...

CVE-2019-19752

nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build...

CVE-2019-19751

CVE-2019-19751 affects easyMINE prior to 2019-12-05 where SSH host keys are baked into the installation image. This permits man-in-the-middle attacks and facilitates identifying all public IPv4 nodes via Shodan. Root cause: hard-coded SSH host keys in the installation artefact. Impact: potential ...

CVE-2019-19752

CVE-2019-19752 affects nvOC up to version 3.2, where SSH host keys are baked into the installation image. This enables man-in-the-middle attacks and could make identifying public IPv4 nodes trivial via Shodan. Public Red Hat advisory confirms the issue and notes the vendor planned a fix in the ne...

CVE-2019-19753

CVE-2019-19753 affects SimpleMiningOS through v1259, where SSH host keys are baked into the installation image. This allows man-in-the-middle attacks and enables easy identification of public IPv4 nodes via Shodan.io. The Red Hat/NVD/CVE entries reiterate the same root cause and note the vendor h...

CVE-2019-19752

nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build...

CVE-2019-19755

ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated that they plan to fix this...

PT-2024-10729 · Ethos · Ethos

Name of the Vulnerable Software and Affected Versions: ethOS versions 1.3.3 and earlier Description: The issue allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io, as the software ships with SSH host keys baked into the installation image. The...

CVE-2024-30407

The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router JCNR and containerized routing Protocol Deamon cRPD products allows an attacker to perform Person-in-the-Middle PitM attacks which results in complete compromise of the container. Due to...

CVE-2024-30407 [Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacks

The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router JCNR and containerized routing Protocol Deamon cRPD products allows an attacker to perform Person-in-the-Middle PitM attacks which results in complete compromise of the container. Due to...

CVE-2024-30407 [Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacks

The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router JCNR and containerized routing Protocol Deamon cRPD products allows an attacker to perform Person-in-the-Middle PitM attacks which results in complete compromise of the container. Due to...

PT-2023-27343 · Pexip · Pexip Vmr

Name of the Vulnerable Software and Affected Versions: Pexip VMR self-service portal versions prior to 3 Description: The issue allows authentication bypass due to the use of the same SSH host key across different customers' installations. Recommendations: For versions prior to 3, update to versi...

Oracle Linux 7 : cloud-init (ELSA-2020-3898)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-3898 advisory. - Resolves: bz1574338 CVE-2018-10896 cloud-init: SSH host keys are not regenerated for the new instances rhel-7 - Resolves: bz1812170 CVE-2020-8632...