USN-6042-1: Cloud-init vulnerability

Publication date

26 April 2023

Overview

cloud-init could write sensitive information to logs.


Packages

  • cloud-init - initialization and customization tool for cloud instances

Details

James Golovich discovered that sensitive data could be exposed in logs. An
attacker could use this information to find hashed passwords and possibly
escalate their privilege.

James Golovich discovered that sensitive data could be exposed in logs. An
attacker could use this information to find hashed passwords and possibly
escalate their privilege.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
23.04 lunar cloud-init –  23.1.2-0ubuntu0~23.04.1
22.10 kinetic cloud-init –  23.1.2-0ubuntu0~22.10.1
22.04 jammy cloud-init –  23.1.2-0ubuntu0~22.04.1
20.04 focal cloud-init –  23.1.2-0ubuntu0~20.04.1
18.04 bionic cloud-init –  23.1.2-0ubuntu0~18.04.1
16.04 xenial cloud-init –  21.1-19-gbad84ad4-0ubuntu1~16.04.4  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›