cloud-init vulnerabilities and exploits

(subscribe to this query)

NA

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

Canonical Ubuntu Linux 20.04 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 22.04 Canonical Ubuntu Linux 22.10 Canonical Ubuntu Linux 23.04 Canonical Cloud-init Fedoraproject Fedora 38

NA

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.

Canonical Cloud-init Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 20.04 Canonical Ubuntu Linux 21.10 Canonical Ubuntu Linux 22.04

NA

When instructing cloud-init to set a random password for a new user account, versions prior to 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.

Canonical Cloud-init

4.6

CVSSv2

cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass inten...

Canonical Snapd Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 19.10 Canonical Ubuntu Linux 20.04

2.1

CVSSv2

cloud-init up to and including 19.4 relies on Mersenne Twister for a random password, which makes it easier for malicious users to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.

Canonical Cloud-init Opensuse Leap 15.1 Debian Debian Linux 8.0

2.1

CVSSv2

In cloud-init up to and including 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for malicious users to guess passwords.

Canonical Cloud-init Opensuse Leap 15.1 Debian Debian Linux 8.0

9

CVSSv2

An privilege elevation vulnerability exists in Cloud-init prior to 0.7.0 when requests to an untrusted system are submitted for EC2 instance data.

Canonical Cloud-init Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Suse Linux Enterprise Server 11

1.9

CVSSv2

A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.

Canonical Ubuntu Linux 18.04

1 Article

4

CVSSv2

In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface.

Redhat Ovirt-engine 4.1.0

3.6

CVSSv2

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ss...

Canonical Cloud-init

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook