CVE-2022-2084

Name

CVE-2022-2084

Description

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.

NVD Severity

unknown

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

References

Type	URI
MISC	https://github.com/canonical/cloud-init/commit/4d467b14363d800b2185b89790d57871f11ea88c
MISC	https://ubuntu.com/security/notices/USN-5496-1

Match rules

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:canonical:cloud-init::::::::`	cloud-init	>= None	< 22.3

Vulnerable and fixed packages

Source package	Branch	Version	Maintainer	Status
cloud-init	edge-community	22.2.2-r0	Dermot Bradley <dermot_bradley@yahoo.com>	fixed
cloud-init	edge-community	21.1-r1	None	possibly vulnerable
cloud-init	3.22-community	22.2.2-r0	None	fixed
cloud-init	3.22-community	21.1-r1	None	possibly vulnerable
cloud-init	3.21-community	22.2.2-r0	None	fixed
cloud-init	3.20-community	22.2.2-r0	None	fixed
cloud-init	3.19-community	22.2.2-r0	None	fixed
cloud-init	3.18-community	22.2.2-r0	None	fixed
cloud-init	3.17-community	22.2.2-r0	None	fixed