CVE-2022-2084

2022-06-2900:00:00

ubuntu.com

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

Sensitive data could be exposed in world readable logs of cloud-init before
version 22.3 when schema failures are reported. This leak could include
hashed passwords.

Bugs

<https://bugs.launchpad.net/cloud-init/+bug/1978422>

Notes

Author	Note
sbeattie	introduced in 22.2, therefore xenial and trusty are not affected

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchcloud-init< 22.2-0ubuntu1~18.04.3UNKNOWN
ubuntu20.04noarchcloud-init< 22.2-0ubuntu1~20.04.3UNKNOWN
ubuntu21.10noarchcloud-init< 22.2-0ubuntu1~21.10.3UNKNOWN
ubuntu22.04noarchcloud-init< 22.2-0ubuntu1~22.04.3UNKNOWN
ubuntu22.10noarchcloud-init< 22.2-64-g1fcd55d6-0ubuntu1~22.10.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	cloud-init	< 22.2-0ubuntu1~18.04.3	UNKNOWN
ubuntu	20.04	noarch	cloud-init	< 22.2-0ubuntu1~20.04.3	UNKNOWN
ubuntu	21.10	noarch	cloud-init	< 22.2-0ubuntu1~21.10.3	UNKNOWN
ubuntu	22.04	noarch	cloud-init	< 22.2-0ubuntu1~22.04.3	UNKNOWN
ubuntu	22.10	noarch	cloud-init	< 22.2-64-g1fcd55d6-0ubuntu1~22.10.1	UNKNOWN