Skip to content
OpenAdvisories
Medium RHSA-2021:3371 1 CVE

Red Hat Security Advisory: cloud-init security update

Published Sep 16, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream cloud-init 0:18.5-12.el8_2.10

Vulnerabilities 1

  • Medium 5.5
    CVE-2021-3429

    sensitive data exposure in cloud-init logs

    When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.

    Canonical cloud-init cloud-init cloud-init Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1940967
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3371.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-3429
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3429
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3429