When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cloud-init | May 4, 2022 | Aug 10, 2021 |
| Alpine Linux | — | Upgrade cloud-init | Aug 22, 2024 | Apr 19, 2023 |
| Amazon Linux Ami 2 | — | Upgrade cloud-init | Mar 22, 2021 | Mar 22, 2021 |
| Amazon_linux | — | Upgrade cloud-init | Mar 20, 2021 | Mar 18, 2021 |
| Centos_linux | — | Upgrade cloud-init | Aug 12, 2021 | Aug 10, 2021 |
| Debian | — | Upgrade cloud-init | Mar 22, 2021 | Mar 22, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade cloud-init | Nov 2, 2021 | Nov 2, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade cloud-init | Nov 12, 2021 | Nov 2, 2021 |
| Oracle_linux | — | Upgrade cloud-init | Aug 12, 2021 | Mar 23, 2021 |
| Redhat_linux | — | Upgrade cloud-initNo solution exists | Aug 12, 2021 | Aug 10, 2021 |
| Rocky_linux | — | — | Aug 15, 2024 | Apr 19, 2023 |
| Suse | — | Upgrade cloud-initUpgrade cloud-init-config-suse | May 11, 2023 | Apr 19, 2023 |
| Ubuntu | — | Upgrade cloud-init | Nov 19, 2024 | Apr 19, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub