CVE-2023-1786

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.(CVE-2023-1786)

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.

Security Fix(es):

• cloud-init: sensitive data could be exposed in logs (CVE-2023-1786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.

Security Fix(es):

• cloud-init: sensitive data could be exposed in logs (CVE-2023-1786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2023-1786: fix leak of sensitive user/vendor data and enforce 640 perms on cloud-init.log

• CVE-2024-6174: fix platform enumeration by changing default policy of ds-identify to disallow discovery of datasources without strict identifiable
• CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent unprivileged user from triggering hotplug-hook commands
• CVE-2023-1786: fix leak of sensitive user/vendor data and enforce 640 perms on cloud-init.log
• CVE-2022-2084: remove schema errors from log to avoid leaking sensitive user-data values into world-readable /var/log/cloud-init.log
• rebuild with the vendor .el9_2 dist so the update outranks AlmaLinux 22.1-10.el9_2.alma

These are all security issues fixed in the cloud-init-23.1-2.1 package on the GA media of openSUSE Tumbleweed.

This update for cloud-init fixes the following issues:

• Default route is not configured (bsc#1212879)
• cloud-final service failing in powerVS (bsc#1210273)
• Randomly generated passwords logged in clear-text to world-readable file (bsc#1184758, CVE-2021-3429)

This update for cloud-init contains following fixes:

• CVE-2021-3429: Do not write the generated password to the log file. (bsc#1184758)
• CVE-2023-1786: Do not expose sensitive data gathered from the CSP. (bsc#1210277)

Other fixes:

• Change log file creation mode to 640. (bsc#1183939)
• Write proper bonding option configuration for SLE/openSUSE. (bsc#1184085)
• Do not including sudoers.d directory twice. (bsc#1181283)

This update for cloud-init fixes the following issues:

• CVE-2023-1786: Do not expose sensitive data gathered from the CSP. (bsc#1210277)

• CVE-2022-2084: Fixed a bug which caused logging schema failures can include password hashes. (bsc#1210652)

• Update to version 23.1

  • Support transactional-updates for SUSE based distros
  • Set ownership for new folders in Write Files Module
  • add OpenCloudOS and TencentOS support
  • lxd: Retry if the server isn't ready
  • test: switch pycloudlib source to pypi
  • test: Fix integration test deprecation message
  • Recognize opensuse-microos, dev tooling fixes
  • sources/azure: refactor imds handler into own module
  • docs: deprecation generation support
  • add function is_virtual to distro/FreeBSD
  • cc_ssh: support multiple hostcertificates
  • Fix minor schema validation regression and fixup typing
  • doc: Reword user data debug section
  • cli: schema also validate vendordata*.
  • ci: sort and add checks for cla signers file
  • Add 'ederst' as contributor
  • readme: add reference to packages dir
  • docs: update downstream package list
  • docs: add google search verification
  • docs: fix 404 render use default notfound_urls_prefix in RTD conf
  • Fix OpenStack datasource detection on bare metal
  • docs: add themed RTD 404 page and pointer to readthedocs-hosted
  • schema: fix gpt labels, use type string for GUID
  • cc_disk_setup: code cleanup
  • netplan: keep custom strict perms when 50-cloud-init.yaml exists
  • cloud-id: better handling of change in datasource files
  • Warn on empty network key
  • Fix Vultr cloud_interfaces usage
  • cc_puppet: Update puppet service name
  • docs: Clarify networking docs
  • lint: remove httpretty
  • cc_set_passwords: Prevent traceback when restarting ssh
  • tests: fix lp1912844
  • tests: Skip ansible test on bionic
  • Wait for NetworkManager
  • docs: minor polishing
  • CI: migrate integration-test to GH actions
  • Fix permission of SSH host keys
  • Fix default route rendering on v2 ipv6
  • doc: fix path in net_convert command
  • docs: update net_convert docs
  • doc: fix dead link
  • cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
  • distros/rhel.py: _read_hostname() missing strip on 'hostname'
  • integration tests: add IBM VPC support
  • machine-id: set to uninitialized to trigger regeneration on clones
  • sources/azure: retry on connection error when fetching metdata
  • Ensure ssh state accurately obtained
  • bddeb: drop dh-systemd dependency on newer deb-based releases
  • doc: fix config formats link in cloudsigma.rst
  • Fix wrong subp syntax in cc_set_passwords.py
  • docs: update the PR template link to readthedocs
  • ci: switch unittests to gh actions
  • Add mount_default_fields for PhotonOS.
  • sources/azure: minor refactor for metadata source detection logic
  • add 'CalvoM' as contributor
  • ci: doc to gh actions
  • lxd: handle 404 from missing devices route for LXD 4.0
  • docs: Diataxis overhaul
  • vultr: Fix issue regarding cache and region codes
  • cc_set_passwords: Move ssh status checking later
  • Improve Wireguard module idempotency
  • network/netplan: add gateways as on-link when necessary
  • tests: test_lxd assert features.networks.zones when present
  • Use btrfs enquque when available (#1926) [Robert Schweikert]
  • sources/azure: fix device driver matching for net config (#1914)
  • BSD: fix duplicate macs in Ifconfig parser
  • pycloudlib: add lunar support for integration tests
  • nocloud: add support for dmi variable expansion for seedfrom URL
  • tools: read-version drop extra call to git describe --long
  • doc: improve cc_write_files doc
  • read-version: When insufficient tags, use cloudinit.version.get_version
  • mounts: document weird prefix in schema
  • Ensure network ready before cloud-init service runs on RHEL
  • docs: add copy button to code blocks
  • netplan: define…

This update for cloud-init contains the following fixes:

• Move fdupes call back to %install.(bsc#1214169)

• Update to version 23.3. (bsc#1216011)

  • (bsc#1215794)
  • (bsc#1215740)
  • (bsc#1216007)
  • Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  • Fix cc_keyboard in mantic (LP: #2030788)
  • ec2: initialize get_instance_userdata return value to bytes (#4387) [Noah Meyerhans]
  • cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  • Fix pip-managed ansible
  • status: treat SubState=running and MainPID=0 as service exited
  • azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  • collect-logs fix memory usage (SC-1590) (#4289) [Alec Warren] (LP: #1980150)
  • cc_mounts: Use fallocate to create swapfile on btrfs (#4369)
  • Undocument nocloud-net (#4318)
  • feat(akamai): add akamai to settings.py and apport.py (#4370)
  • read-version: fallback to get_version when git describe fails (#4366)
  • apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  • integration tests: Pass username to pycloudlib (#4324)
  • Bump pycloudlib to 1!5.1.0 (#4353)
  • cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272) [dermotbradley]
  • analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  • cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  • subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  • cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  • util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  • cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  • unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource (#4328) [Ani Sinha]
  • Fix test_tools.py collection (#4315)
  • cc_keyboard: add Alpine support (#4278) [dermotbradley]
  • Flake8 fixes (#4340) [Robert Schweikert]
  • cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  • ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281) [Wei Zhou]
  • ec2: Support double encoded userdata (#4275) [Noah Meyerhans]
  • cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  • tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336) [Chris Patterson]
  • change openEuler to openeuler and fix some bugs in openEuler (#4317) [sxt1001]
  • Replace flake8 with ruff (#4314)
  • NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64 (#4291) [Ani Sinha]
  • cc_ssh_import_id: add Alpine support and add doas support (#4277) [dermotbradley]
  • sudoers not idempotent (SC-1589) (#4296) [Alec Warren] (LP: #1998539)
  • Added support for Akamai Connected Cloud (formerly Linode) (#4167) [Will Smith]
  • Fix reference before assignment (#4292)
  • Overhaul module reference page (#4237) [Sally]
  • replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  • DS VMware: modify a few log level (#4284) [PengpengSun]
  • tools/read-version refactors and unit tests (#4268)
  • Ensure get_features() grabs all features (#4285)
  • Don't always require passlib dependency (#4274)
  • tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  • Fix NoCloud kernel commandline key parsing (#4273)
  • testing: Clear all LRU caches after each test (#4249)
  • Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  • logging: keep current file mode of log file if its stricter than the new mode (#4250) [Ani Sinha]
  • Remove default membership in redundant groups (#4258) [Dave Jones] (LP: #1923363)
  • doc: improve datasource_creation.rst (#4262)
  • Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  • tools/read-version: fix the tool so that it can handle version parsing errors (#4234) [Ani Sinha]
  • net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  • DS VMware: add i386 arch dir to deployPkg plugin search path [PengpengSun]
  • LXD moved from…

This update for cloud-init fixes the following issues:

Update to version 25.1.3:

• CVE-2024-6174: Unpriveleged user could trigger hotplug-hook commands (bsc#1245403).

None security fixes:

• Rebase cloud-init to 24.4 or higher (bsc#1239715, jsc#PED-8680).
• Fixed cloud-init --debug status (bsc#1228414).
• Using ssh_pwauth: True in cloud-init breaks ssh for root (bsc#1237764).
• Fixed FileNotFoundError (bsc#1236720).
• Fixed python 3.13 support (bsc#1233649).

This update for cloud-init fixes the following issues:

Update to version 25.1.3 (bsc#1245401,bsc#1245403):

• docs: provide example3 for PAM and ssh_pwauth behavior (#27)
• fix: Make hotplug socket writable only by root (#25) (CVE-2024-11584)
• fix: Don't attempt to identify non-x86 OpenStack instances (LP: #2069607) (CVE-2024-6174)

From 25.1.2:

• fix: ensure MAAS datasource retries on failure (#6167)

Update to version 25.1.1 (bsc#1239715,jsc#PED-8680,bsc#1228414):

• Drop hidesensitivedata in 16 & greater
• test: pytestify cc_chef tests, add migration test
• chef: migrate files in old config directories for backups and cache
• fix: correct the path for Chef's backups (#5994)
• fix(Azure): don't reraise FileNotFoundError during ephemeral setup (#6113)
• fix(azure): handle unexpected exceptions during obtain_lease() (#6092) [Ksenija Stanojevic]
• Allow to set mac_address for VLAN subinterface (#6081) [jumpojoy] (GH: 5364)
• fix: Remove erroneous EC2 reference from 503 warning (#6077)
• fix: NM reload and bring up individual network conns (#6073) [Ani Sinha]
• fix: stop warning on dual-stack request failure (#6044)
• fix: install_method: pip cannot find ansible-pull command path (#6021) [Hasan Aliyev] (GH: 5720)
• fix: Fix DataSourceAliYun exception_cb signature (#6068) (GH: 6066)
• fix: Update OauthUrlHelper to use readurl exception_cb signature (GH: 6065)
• test: add OauthUrlHelper tests
• test: Remove CiTestCase from test_url_helper.py
• test: pytestify test_url_helper.py
• fix: track more removed modules (#6043)

From 25.1:

• ci: fix post-merge packaging CI (#6038)
• feat(azure): Fix imds-based ssh_pwauth (#6002) [Ksenija Stanojevic]
• ci: check for sorted patches (#6036)
• feat: aliyun datasource support crawl metadata at once (#5942) [jinkangkang]
• docs: document /usr merge breaking change (#6032)
• test: Add integration test for /var mounts (#6033)
• test: Ensure pre-24.2 custom modules work (#6034)
• doc: Update references to older keys (#6022) [Pedro Ribeiro]
• fix: untyped-defs in tests/unittests/{config, net, sources} (#6023) [Romain]
• fix: don't reference PR in post-merged CI (#6019)
• chore: explicitly skip broken ansible integration tests (#5996) [a-dubs]
• tests(oracle): fix test_install_missing_deps apt race condition (#5996) [a-dubs]
• test(oracle): fix test_ubuntu_drivers_installed (#5996) [a-dubs]
• test(oracle): fix test_frequency_override integration test (#5996) [a-dubs]
• chore: add type hint to IntegrationCloud's cloud_instance field (#5996) [a-dubs]
• test(oracle): fix modules/test_lxd.py::test_storage_lvm on noble (#5996) [a-dubs]
• commit 9e591fff266be9d4c83f74ec02a717b74993304d [a-dubs]
• net/sysconfig: do not remove all existing settings of /etc/sysconfig/network (#5991) [Ani Sinha] (GH: 5990)
• fix: remove wrong return when checking if network necessary (#6013)
• fix: typing for rsyslog, ubuntu_pro, power_state_change (#5985) [MostafaTarek124eru]
• fix: Retry on OpenStack HTTP status codes (#5943) [weiyang] (GH: 5687)
• fix: Ensure fqdn is treated as string in get_hostname_fqdn (#5993) [MKhatibzadeh] (GH: 5989)
• feat(vmware): Convert imc network config to v2 (#5937) [PengpengSun]
• ci: add upstream post-merge test
• ci: check if upstream commit causes ubuntu patch conflicts
• ci: organize cla tests together
• test: eliminate obsolete cases, add non-error case
• chore: remove redundant manual schema validation
• doc: clarify subiquity docs
• chore: cleanup `len' usage (#5956) [Shreenidhi Shedi]
• Fix: GCE _get_data crashes if DHCP lease fails (#5998) [Bryan Fraschetti]
• Fixes GH-5997
• fix: correct the path for Chef's cache (#5994) [MostafaTarek124eru] (GH: 5090)
• fix: Run ansible with run_user instead of root for distro install_method (#5986) [Amirhossein Shaerpour] (GH: 4092)
• fix: retry AWS hotplug for async IMDS (#5995) (GH: 5373)
• feat(integration_tests): add optional…

James Golovich discovered that sensitive data could be exposed in logs. An attacker could use this information to find hashed passwords and possibly escalate their privilege.