CVE-2021-3429

CWE-532 — Log File Information Exposure6 documents6 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 83.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Canonical Ltd. Cloud-initCanonical Cloud-init
Timeline
PublishedApr 19
Latest updateApr 20

Description

When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5canonical_ltd./cloud-init< 21.2
▶Debiancloud-init< 20.4.1-2+3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-jj89-4799-j2qv: When instructing cloud-init to set a random password for a new user account, versions before 21↗2023-04-20
▶
CVEList
sensitive data exposure in cloud-init logs↗2023-04-19
▶
OSV
CVE-2021-3429: When instructing cloud-init to set a random password for a new user account, versions before 21↗2023-04-19
▶

📋Vendor Advisories

2
Red Hat
cloud-init: randomly generated passwords logged in clear-text to world-readable file↗2021-03-23
▶
Debian
CVE-2021-3429: cloud-init - When instructing cloud-init to set a random password for a new user account, ver...↗2021
▶
CVE-2021-3429 (MEDIUM CVSS 5.5) | When instructing cloud-init to set | cvebase.io