Description
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | Ubuntu | ≤ 24.04.4, ≤ 25.10, ≤ 25.04 | — |
References
- feat: don't log identity data (noble backport) patch issue-tracking
- feat: don't log identity data patch issue-tracking