Packages
- cloud-init - initialization and customization tool for cloud instances
Details
Mike Stroyan discovered that cloud-init could log password hashes when
reporting schema failures. An attacker with access to these logs could
potentially use this to gain user credentials.
Mike Stroyan discovered that cloud-init could log password hashes when
reporting schema failures. An attacker with access to these logs could
potentially use this to gain user credentials.
Update instructions
In general, a standard system update will make the necessary changes. Please note that sensitive information may have been logged to remote logging aggregators as well as to the system journal, and removal of such information may be required. Similarly, cloud-init configurations that log in non-default locations may also require the removal of sensitive information.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 22.04 jammy | cloud-init – 22.2-0ubuntu1~22.04.3 | ||
| 21.10 impish | cloud-init – 22.2-0ubuntu1~21.10.3 | ||
| 20.04 focal | cloud-init – 22.2-0ubuntu1~20.04.3 | ||
| 18.04 bionic | cloud-init – 22.2-0ubuntu1~18.04.3 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.