Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-cloud-init | Nov 16, 2023 | Apr 26, 2023 | |
| Alpine Linux | alpine-linux-upgrade-cloud-init | Aug 22, 2024 | Apr 26, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-cloud-init | Nov 18, 2024 | Apr 26, 2023 | |
| Centos_linux | — | centos-upgrade-cloud-init | Nov 8, 2023 | Apr 26, 2023 |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Apr 26, 2023 | |
| Freebsd | freebsd-upgrade-package-cloud-initfreebsd-upgrade-package-cloud-init-devel | May 2, 2023 | Apr 29, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-cloud-init | Jan 10, 2024 | Apr 26, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-cloud-init | Jan 10, 2024 | Apr 26, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-cloud-init | Jan 10, 2024 | Apr 26, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-cloud-init | Aug 9, 2023 | Apr 26, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-cloud-init | Apr 28, 2023 | Apr 27, 2023 |
| Redhat_linux | redhat-upgrade-cloud-init | Nov 8, 2023 | Apr 26, 2023 | |
| Suse | — | suse-upgrade-cloud-initsuse-upgrade-cloud-init-config-susesuse-upgrade-cloud-init-doc | May 11, 2023 | Apr 26, 2023 |
| Ubuntu | ubuntu-upgrade-cloud-init | May 1, 2023 | Apr 26, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Apr 26, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub