USN-5496-1: cloud-init vulnerability
Mike Stroyan discovered that cloud-init could log password hashes when reporting schema failures. An attacker with access to these logs could potentially use this to gain user credentials.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this cloud-init vulnerability?
The vulnerability ID for this cloud-init vulnerability is CVE-2022-2084.
What is the severity of CVE-2022-2084?
The severity of CVE-2022-2084 is not specified.
How can an attacker exploit CVE-2022-2084?
An attacker with access to cloud-init logs could potentially use CVE-2022-2084 to gain user credentials.
Which versions of cloud-init are affected by CVE-2022-2084?
Versions 22.2-0ubuntu1~22.04.3, 22.2-0ubuntu1~21.10.3, 22.2-0ubuntu1~20.04.3, and 22.2-0ubuntu1~18.04.3 of cloud-init are affected by CVE-2022-2084.
How do I fix CVE-2022-2084?
To fix CVE-2022-2084, update cloud-init to version 22.2-0ubuntu1~22.04.3, 22.2-0ubuntu1~21.10.3, 22.2-0ubuntu1~20.04.3, or 22.2-0ubuntu1~18.04.3, depending on the Ubuntu version you are using.