CVE-2022-2084

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.(CVE-2022-2084)

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.

• CVE-2022-2084: remove schema errors from log to avoid leaking sensitive user-data values into world-readable /var/log/cloud-init.log

• CVE-2024-6174: fix platform enumeration by changing default policy of ds-identify to disallow discovery of datasources without strict identifiable
• CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent unprivileged user from triggering hotplug-hook commands
• CVE-2023-1786: fix leak of sensitive user/vendor data and enforce 640 perms on cloud-init.log
• CVE-2022-2084: remove schema errors from log to avoid leaking sensitive user-data values into world-readable /var/log/cloud-init.log
• rebuild with the vendor .el9_2 dist so the update outranks AlmaLinux 22.1-10.el9_2.alma

These are all security issues fixed in the cloud-init-23.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cloud-init fixes the following issues:

• CVE-2023-1786: Do not expose sensitive data gathered from the CSP. (bsc#1210277)

• CVE-2022-2084: Fixed a bug which caused logging schema failures can include password hashes. (bsc#1210652)

• Update to version 23.1

  • Support transactional-updates for SUSE based distros
  • Set ownership for new folders in Write Files Module
  • add OpenCloudOS and TencentOS support
  • lxd: Retry if the server isn't ready
  • test: switch pycloudlib source to pypi
  • test: Fix integration test deprecation message
  • Recognize opensuse-microos, dev tooling fixes
  • sources/azure: refactor imds handler into own module
  • docs: deprecation generation support
  • add function is_virtual to distro/FreeBSD
  • cc_ssh: support multiple hostcertificates
  • Fix minor schema validation regression and fixup typing
  • doc: Reword user data debug section
  • cli: schema also validate vendordata*.
  • ci: sort and add checks for cla signers file
  • Add 'ederst' as contributor
  • readme: add reference to packages dir
  • docs: update downstream package list
  • docs: add google search verification
  • docs: fix 404 render use default notfound_urls_prefix in RTD conf
  • Fix OpenStack datasource detection on bare metal
  • docs: add themed RTD 404 page and pointer to readthedocs-hosted
  • schema: fix gpt labels, use type string for GUID
  • cc_disk_setup: code cleanup
  • netplan: keep custom strict perms when 50-cloud-init.yaml exists
  • cloud-id: better handling of change in datasource files
  • Warn on empty network key
  • Fix Vultr cloud_interfaces usage
  • cc_puppet: Update puppet service name
  • docs: Clarify networking docs
  • lint: remove httpretty
  • cc_set_passwords: Prevent traceback when restarting ssh
  • tests: fix lp1912844
  • tests: Skip ansible test on bionic
  • Wait for NetworkManager
  • docs: minor polishing
  • CI: migrate integration-test to GH actions
  • Fix permission of SSH host keys
  • Fix default route rendering on v2 ipv6
  • doc: fix path in net_convert command
  • docs: update net_convert docs
  • doc: fix dead link
  • cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
  • distros/rhel.py: _read_hostname() missing strip on 'hostname'
  • integration tests: add IBM VPC support
  • machine-id: set to uninitialized to trigger regeneration on clones
  • sources/azure: retry on connection error when fetching metdata
  • Ensure ssh state accurately obtained
  • bddeb: drop dh-systemd dependency on newer deb-based releases
  • doc: fix config formats link in cloudsigma.rst
  • Fix wrong subp syntax in cc_set_passwords.py
  • docs: update the PR template link to readthedocs
  • ci: switch unittests to gh actions
  • Add mount_default_fields for PhotonOS.
  • sources/azure: minor refactor for metadata source detection logic
  • add 'CalvoM' as contributor
  • ci: doc to gh actions
  • lxd: handle 404 from missing devices route for LXD 4.0
  • docs: Diataxis overhaul
  • vultr: Fix issue regarding cache and region codes
  • cc_set_passwords: Move ssh status checking later
  • Improve Wireguard module idempotency
  • network/netplan: add gateways as on-link when necessary
  • tests: test_lxd assert features.networks.zones when present
  • Use btrfs enquque when available (#1926) [Robert Schweikert]
  • sources/azure: fix device driver matching for net config (#1914)
  • BSD: fix duplicate macs in Ifconfig parser
  • pycloudlib: add lunar support for integration tests
  • nocloud: add support for dmi variable expansion for seedfrom URL
  • tools: read-version drop extra call to git describe --long
  • doc: improve cc_write_files doc
  • read-version: When insufficient tags, use cloudinit.version.get_version
  • mounts: document weird prefix in schema
  • Ensure network ready before cloud-init service runs on RHEL
  • docs: add copy button to code blocks
  • netplan: define…

Mike Stroyan discovered that cloud-init could log password hashes when reporting schema failures. An attacker with access to these logs could potentially use this to gain user credentials.