Untriaged
Permalink
CVE-2021-3429
5.5 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
sensitive data exposure in cloud-init logs
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
References
- https://github.com/canonical/cloud-init/commit/b794d426b9ab43ea9d6371477466070d… patch
- https://github.com/canonical/cloud-init/commit/b794d426b9ab43ea9d6371477466070d… patch x_transferred
- https://github.com/canonical/cloud-init/commit/b794d426b9ab43ea9d6371477466070d… patch
- https://github.com/canonical/cloud-init/commit/b794d426b9ab43ea9d6371477466070d… patch x_transferred
Affected products
cloud-init
- <21.2
Matching in nixpkgs
pkgs.cloud-init
Provides configuration and customization of cloud instance
-
nixos-unstable -
- nixpkgs-unstable 25.2
Package maintainers
-
@jfroche Jean-François Roche <jfroche@pyxel.be>
-
@illustris Harikrishnan R <me@illustris.tech>