Inclusion of Sensitive Information in Log Files in cloud-init (Ubuntu package) - CVE-2022-2084

Vulnerability identifier: #VU64838

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2084

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to logged schema failures can include password hashes. A local user can read the log files and gain access to sensitive data.

cloud-init (Ubuntu package)
cloud-init
cloud-init-help
cloud-init-doc
cloud-init-config-suse
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Public Cloud Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS

Install updates from vendor's website.

cloud-init (Ubuntu package) - addressed in versions 22.2-0ubuntu1~18.04.3, 22.2-0ubuntu1~20.04.3, 22.2-0ubuntu1~21.10.3, 22.2-0ubuntu1~22.04.3
cloud-init - update to 19.4-10
cloud-init-help - update to 19.4-10
cloud-init-doc - update to 23.1-150100.8.63.5
cloud-init - update to 23.1-150100.8.63.5
cloud-init-config-suse - update to 23.1-150100.8.63.5
cloud-init - update to 23.2.2-1

• https://ubuntu.com/security/notices/USN-5496-1
• https://ubuntu.com/security/CVE-2022-2084

• Ubuntu update for cloud-init
• SUSE update for cloud-init
• openEuler update for cloud-init
• Anolis OS update for cloud-init
• Anolis OS update for cloud-init
• Anolis OS update for cloud-init