Skip to content
OpenAdvisories
Medium DLA-2601-1 1 CVE

cloud-init - security update

Published Mar 20, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 cloud-init 0.7.9-2+deb9u1

Vulnerabilities 1

  • Medium 5.5
    CVE-2021-3429

    sensitive data exposure in cloud-init logs

    When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.

    Canonical cloud-init cloud-init cloud-init Debian Ubuntu Alpine