CVE-2012-6639
First published: Mon Nov 25 2019(Updated: )
An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/cloud-init | 20.2-2~deb10u2 20.4.1-2+deb11u1 22.4.2-1 23.3.1-1 | |
| Canonical Cloud-init | <0.7.0 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| SUSE Linux Enterprise Server | =11-sp2 | |
| SUSE Linux Enterprise Server | =11-sp3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://article.gmane.org/gmane.comp.security.oss.general/12299
- https://security-tracker.debian.org/tracker/CVE-2012-6639
- http://www.openwall.com/lists/oss-security/2014/03/06/7
- https://access.redhat.com/security/cve/cve-2012-6639
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6639
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2012-6639
- https://www.securityfocus.com/bid/66019/references
Frequently Asked Questions
What is CVE-2012-6639?
CVE-2012-6639 is a privilege elevation vulnerability in Cloud-init before version 0.7.0.
What is the severity of CVE-2012-6639?
The severity of CVE-2012-6639 is critical with a CVSS score of 8.8.
How does CVE-2012-6639 affect Cloud-init?
CVE-2012-6639 affects Cloud-init versions before 0.7.0 and allows for privilege elevation when making requests to an untrusted system for EC2 instance data.
Which software packages are affected by CVE-2012-6639?
Cloud-init packages from Debian, Canonical Cloud-init, and various versions of Debian Linux and SUSE Linux Enterprise Server are affected by CVE-2012-6639.
Where can I find more information about CVE-2012-6639?
You can find more information about CVE-2012-6639 at the following references: http://article.gmane.org/gmane.comp.security.oss.general/12299, https://security-tracker.debian.org/tracker/CVE-2012-6639, and http://www.openwall.com/lists/oss-security/2014/03/06/7
- collector/security-tracker-debian
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/event
- agent/type
- agent/description
- agent/tags
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/canonical
- canonical/canonical cloud-init
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/suse
- canonical/suse linux enterprise server
- version/suse linux enterprise server/11-sp2
- version/suse linux enterprise server/11-sp3