Summary
Mike Stroyan discovered that cloud-init could log password hashes when
reporting schema failures. An attacker with access to these logs could
potentially use this to gain user credentials.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | cloud-init | 22.2-0ubuntu1~18.04.3 |
| Ubuntu · 20.04 LTS 20.04:LTS | cloud-init | 22.2-0ubuntu1~20.04.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | cloud-init | 22.2-0ubuntu1~22.04.3 |
Vulnerabilities 1
-
Medium 5.5
sensitive data exposure in cloud-init logs
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
References
-
report
https://ubuntu.com/security/CVE-2022-2084