Skip to content
OpenAdvisories
Medium ALAS2-2021-1620 1 CVE

Moderate: cloud-init security update (Amazon Linux 2)

Published Mar 18, 2021 · Updated Mar 19, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3429: A vulnerability was discovered in cloud-init which can improperly disclose randomly generated passwords as part of the chpasswd module. The fix prevents the generated password from being written to a world-readable log file on the local disk.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 cloud-init 0:19.3-43.amzn2

Vulnerabilities 1

  • Medium 5.5
    CVE-2021-3429

    sensitive data exposure in cloud-init logs

    When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.

    Canonical cloud-init cloud-init cloud-init Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-3429.html