CVE-2022-2084: sensitive data exposure in cloud-init logs

Q: What is CVE-2022-2084?

CVE-2022-2084 is a vulnerability that could expose sensitive data in world-readable logs of cloud-init before version 22.3 when schema failures are reported.

Q: What is the severity of CVE-2022-2084?

The severity of CVE-2022-2084 is medium with a severity value of 5.5.

Q: Which software versions are affected by CVE-2022-2084?

The vulnerability affects cloud-init versions before 22.3 and Canonical Ubuntu Linux 18.04, 20.04, 21.10, and 22.04.

Q: How can I fix CVE-2022-2084?

To fix CVE-2022-2084, update your cloud-init software to version 22.3 or above.

Q: Where can I find more information about CVE-2022-2084?

You can find more information about CVE-2022-2084 at the following references: [reference 1](https://github.com/canonical/cloud-init/commit/4d467b14363d800b2185b89790d57871f11ea88c), [reference 2](https://ubuntu.com/security/notices/USN-5496-1), [reference 3](https://launchpad.net/bugs/cve/CVE-2022-2084).

Published Apr 19, 2023

Updated

Last updated 24 July 2024

Other sources

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.

— Launchpad

Affected Software

10 affected componentsFixes available

cloud-init<22.3

Ubuntu=18.04

Ubuntu=20.04

Ubuntu=21.10

Ubuntu=22.04

Ubuntu Linux=18.04

Ubuntu Linux=20.04

Ubuntu Linux=21.10

Ubuntu Linux=22.04

debian/cloud-init

20.4.1-2+deb11u122.4.2-1+deb12u225.1-1

Remediation

Patch Available

https://github.com/canonical/cloud-init/commit/4d467b14363d800b2185b89790d57871f11ea88c

Mitigation

The Ubuntu update to address this attempted to redact information contained in /var/log/cloud-init.log. Additional logs may require the removal of sensitive information; such information would be preceded by the following text: Invalid cloud-config provided:

Event History

Apr 19, 2023

CVE Published

via MITRE·09:47 PM

Data Sourced

via MITRE·09:47 PM

DescriptionSeverityWeakness

Jan 12, 2024

Data Sourced

via Launchpad·12:05 AM

Description

Sep 16, 2024

Data Sourced

via Ubuntu·01:24 AM

RemedyDescriptionSeverityAffected Software

Feb 25, 2025

Data Sourced

via Debian·11:35 PM

DescriptionAffected Software

Frequently Asked Questions

What is CVE-2022-2084?

CVE-2022-2084 is a vulnerability that could expose sensitive data in world-readable logs of cloud-init before version 22.3 when schema failures are reported.

What is the severity of CVE-2022-2084?

The severity of CVE-2022-2084 is medium with a severity value of 5.5.

Which software versions are affected by CVE-2022-2084?

The vulnerability affects cloud-init versions before 22.3 and Canonical Ubuntu Linux 18.04, 20.04, 21.10, and 22.04.

How can I fix CVE-2022-2084?

To fix CVE-2022-2084, update your cloud-init software to version 22.3 or above.

Where can I find more information about CVE-2022-2084?

You can find more information about CVE-2022-2084 at the following references: [reference 1](https://github.com/canonical/cloud-init/commit/4d467b14363d800b2185b89790d57871f11ea88c), [reference 2](https://ubuntu.com/security/notices/USN-5496-1), [reference 3](https://launchpad.net/bugs/cve/CVE-2022-2084).

CVE-2022-2084: sensitive data exposure in cloud-init logs

Other sources

Affected Software

Remediation

Patch Available

Mitigation

Event History

Frequently Asked Questions

What is CVE-2022-2084?

What is the severity of CVE-2022-2084?

Which software versions are affected by CVE-2022-2084?

How can I fix CVE-2022-2084?

Where can I find more information about CVE-2022-2084?

Company

Resources

Contact