Description
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Canonical Ltd. cloud-init
0 to < 23.1.2affected
References
- https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813f6fe0a6b ↗
- https://bugs.launchpad.net/cloud-init/+bug/2013967 ↗
- https://ubuntu.com/security/notices/USN-6042-1 ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ATBJSXPL2IOAD2LDQRKWPLIC7QXS44GZ/ ↗