CVE-2024-11584

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.

Security Fix(es):

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init 25.1.2 and previous versions. The vulnerability originates from cloud-init-hotplugd.socket's default SocketMode permission is 0666, which may cause unauthorized users to trigger commands.(CVE-2024-11584)

cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security vulnerability in cloud-init, which originates from granting root access to hardcoded URLs during detection by non-x86 platforms.(CVE-2024-6174)

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.

• CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent unprivileged user from triggering hotplug-hook commands

• CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent unprivileged user from triggering hotplug-hook commands

• CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent unprivileged user from triggering hotplug-hook commands
• rebuild with the vendor .el9_6 dist so the update outranks AlmaLinux 24.4-4.el9_6.3.alma.1

• CVE-2024-6174: fix platform enumeration by changing default policy of ds-identify to disallow discovery of datasources without strict identifiable
• CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent unprivileged user from triggering hotplug-hook commands
• CVE-2023-1786: fix leak of sensitive user/vendor data and enforce 640 perms on cloud-init.log
• CVE-2022-2084: remove schema errors from log to avoid leaking sensitive user-data values into world-readable /var/log/cloud-init.log
• rebuild with the vendor .el9_2 dist so the update outranks AlmaLinux 22.1-10.el9_2.alma

This update for cloud-init fixes the following issues:

Changes in cloud-init:

• Fix dependency replace -serial with -pyserial

• Drop unneeded test dependency on httpretty, fixed long ago

  • https://github.com/canonical/cloud-init/pull/1720

• Update to version 25.1.3 (bsc#1245401 , CVE-2024-6174, bsc#1245403, CVE-2024-11584)

These are all security issues fixed in the cloud-init-25.1.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cloud-init fixes the following issues:

Changes in cloud-init:

• Fix dependency replace -serial with -pyserial

• Drop unneeded test dependency on httpretty, fixed long ago

  • https://github.com/canonical/cloud-init/pull/1720

• Update to version 25.1.3 (bsc#1245401 , CVE-2024-6174, bsc#1245403, CVE-2024-11584)

This update for cloud-init fixes the following issues:

Changes in cloud-init:

• Fix dependency replace -serial with -pyserial

• Drop unneeded test dependency on httpretty, fixed long ago

  • https://github.com/canonical/cloud-init/pull/1720

• Update to version 25.1.3 (bsc#1245401 , CVE-2024-6174, bsc#1245403, CVE-2024-11584)

This update for cloud-init fixes the following issues:

Update to version 25.1.3:

• CVE-2024-6174: Unpriveleged user could trigger hotplug-hook commands (bsc#1245403).

None security fixes:

• Rebase cloud-init to 24.4 or higher (bsc#1239715, jsc#PED-8680).
• Fixed cloud-init --debug status (bsc#1228414).
• Using ssh_pwauth: True in cloud-init breaks ssh for root (bsc#1237764).
• Fixed FileNotFoundError (bsc#1236720).
• Fixed python 3.13 support (bsc#1233649).

This update for cloud-init fixes the following issues:

Update to version 25.1.3 (bsc#1245401,bsc#1245403):

• docs: provide example3 for PAM and ssh_pwauth behavior (#27)
• fix: Make hotplug socket writable only by root (#25) (CVE-2024-11584)
• fix: Don't attempt to identify non-x86 OpenStack instances (LP: #2069607) (CVE-2024-6174)

From 25.1.2:

• fix: ensure MAAS datasource retries on failure (#6167)

Update to version 25.1.1 (bsc#1239715,jsc#PED-8680,bsc#1228414):

• Drop hidesensitivedata in 16 & greater
• test: pytestify cc_chef tests, add migration test
• chef: migrate files in old config directories for backups and cache
• fix: correct the path for Chef's backups (#5994)
• fix(Azure): don't reraise FileNotFoundError during ephemeral setup (#6113)
• fix(azure): handle unexpected exceptions during obtain_lease() (#6092) [Ksenija Stanojevic]
• Allow to set mac_address for VLAN subinterface (#6081) [jumpojoy] (GH: 5364)
• fix: Remove erroneous EC2 reference from 503 warning (#6077)
• fix: NM reload and bring up individual network conns (#6073) [Ani Sinha]
• fix: stop warning on dual-stack request failure (#6044)
• fix: install_method: pip cannot find ansible-pull command path (#6021) [Hasan Aliyev] (GH: 5720)
• fix: Fix DataSourceAliYun exception_cb signature (#6068) (GH: 6066)
• fix: Update OauthUrlHelper to use readurl exception_cb signature (GH: 6065)
• test: add OauthUrlHelper tests
• test: Remove CiTestCase from test_url_helper.py
• test: pytestify test_url_helper.py
• fix: track more removed modules (#6043)

From 25.1:

• ci: fix post-merge packaging CI (#6038)
• feat(azure): Fix imds-based ssh_pwauth (#6002) [Ksenija Stanojevic]
• ci: check for sorted patches (#6036)
• feat: aliyun datasource support crawl metadata at once (#5942) [jinkangkang]
• docs: document /usr merge breaking change (#6032)
• test: Add integration test for /var mounts (#6033)
• test: Ensure pre-24.2 custom modules work (#6034)
• doc: Update references to older keys (#6022) [Pedro Ribeiro]
• fix: untyped-defs in tests/unittests/{config, net, sources} (#6023) [Romain]
• fix: don't reference PR in post-merged CI (#6019)
• chore: explicitly skip broken ansible integration tests (#5996) [a-dubs]
• tests(oracle): fix test_install_missing_deps apt race condition (#5996) [a-dubs]
• test(oracle): fix test_ubuntu_drivers_installed (#5996) [a-dubs]
• test(oracle): fix test_frequency_override integration test (#5996) [a-dubs]
• chore: add type hint to IntegrationCloud's cloud_instance field (#5996) [a-dubs]
• test(oracle): fix modules/test_lxd.py::test_storage_lvm on noble (#5996) [a-dubs]
• commit 9e591fff266be9d4c83f74ec02a717b74993304d [a-dubs]
• net/sysconfig: do not remove all existing settings of /etc/sysconfig/network (#5991) [Ani Sinha] (GH: 5990)
• fix: remove wrong return when checking if network necessary (#6013)
• fix: typing for rsyslog, ubuntu_pro, power_state_change (#5985) [MostafaTarek124eru]
• fix: Retry on OpenStack HTTP status codes (#5943) [weiyang] (GH: 5687)
• fix: Ensure fqdn is treated as string in get_hostname_fqdn (#5993) [MKhatibzadeh] (GH: 5989)
• feat(vmware): Convert imc network config to v2 (#5937) [PengpengSun]
• ci: add upstream post-merge test
• ci: check if upstream commit causes ubuntu patch conflicts
• ci: organize cla tests together
• test: eliminate obsolete cases, add non-error case
• chore: remove redundant manual schema validation
• doc: clarify subiquity docs
• chore: cleanup `len' usage (#5956) [Shreenidhi Shedi]
• Fix: GCE _get_data crashes if DHCP lease fails (#5998) [Bryan Fraschetti]
• Fixes GH-5997
• fix: correct the path for Chef's cache (#5994) [MostafaTarek124eru] (GH: 5090)
• fix: Run ansible with run_user instead of root for distro install_method (#5986) [Amirhossein Shaerpour] (GH: 4092)
• fix: retry AWS hotplug for async IMDS (#5995) (GH: 5373)
• feat(integration_tests): add optional…

This update for cloud-init fixes the following issues:

• Update to version 25.1.3 (bsc#1245403, CVE-2024-11584, CVE-2024-6174)
• Update to version 25.1.1 (bsc#1239715, jsc#PED-8680, bsc#1228414, bsc#1237764)
• Make sure a directory exists, if not create it, before writing in that location (bsc#1236720)
• rsyslog warning, '~' is deprecated (bsc#1170154)
• Support python 3.13 (bsc#1233649)
• Move fdupes call back to %install (bsc#1214169)
• Re-ship python dependencies, those have no source changes.

Harry Sintonen discovered that the hotplugd socket in cloud-init was world writable. An attacker could possibly use this issue to send hotplug-hook commands. (CVE-2024-11584)

It was discovered that cloud-init granted root access to a hardcoded URL with a local IP address when a non-x86 platform is detected. An attacker could possibly impersonate an OpenStack endpoint and provide root configuration data. (CVE-2024-6174)