I checked a couple of top images on Docker Hub for pregenerated / hardcoded private keys and noted that the "postgres" images (which is a "Docker Official Image") contain a pregenerated "snakeoil" certificate and private key:
/etc/ssl/private/ssl-cert-snakeoil.key
/etc/ssl/certs/ssl-cert-snakeoil.pem
Those snakeoil certs are autogenerated by Debian, but they are not supposed to be hardcoded. Instead, keys should be generated
on instantiating a container from an image.
The security risk is somewhat limited, as the postgres image does not appear to directly enable TLS, so the certificate is not used in the default configuration. It is however referenced in the config file postgresql-common/root.crt, so it looks like it could easily get enabled and used.
(I reported this to Docker's security contact, but was asked to report it here due to the low security risk. More generally, I think it's worth considering having some safeguards against this for all Docker images, e.g., by auto-scanning them for common pregenerated key paths. But not sure if this is the right place to discuss this.)
I checked a couple of top images on Docker Hub for pregenerated / hardcoded private keys and noted that the "postgres" images (which is a "Docker Official Image") contain a pregenerated "snakeoil" certificate and private key:
Those snakeoil certs are autogenerated by Debian, but they are not supposed to be hardcoded. Instead, keys should be generated
on instantiating a container from an image.
The security risk is somewhat limited, as the postgres image does not appear to directly enable TLS, so the certificate is not used in the default configuration. It is however referenced in the config file postgresql-common/root.crt, so it looks like it could easily get enabled and used.
(I reported this to Docker's security contact, but was asked to report it here due to the low security risk. More generally, I think it's worth considering having some safeguards against this for all Docker images, e.g., by auto-scanning them for common pregenerated key paths. But not sure if this is the right place to discuss this.)