{"id":"CVE-2022-2084","aliases":["ALPINE-CVE-2022-2084","BELL-CVE-2022-2084","CLSA-2026-1782809708","CLSA-2026-1791533950","DEBIAN-CVE-2022-2084","EUVD-2022-34374","GHSA-w62x-qh57-5m94","OESA-2023-1290","SUSE-SU-2023:2628-1","UBUNTU-CVE-2022-2084","USN-5496-1","openSUSE-SU-2024:12738-1"],"status":"published","title":"sensitive data exposure in cloud-init logs","description":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00236,"percentile":0.14674,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2022-06-29T21:00:00Z","modified":"2026-11-03T08:02:10Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"cloud-init","fixed_in":["22.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"cloud-init","fixed_in":["22.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cloud-init","fixed_in":["22.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cloud-init","fixed_in":["22.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cloud-init","fixed_in":["22.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cloud-init","fixed_in":["22.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cloud-init","fixed_in":["22.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cloud-init","fixed_in":["22.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cloud-init","fixed_in":["22.2.2-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cloud-init","fixed_in":["22.1-10.el9.alma.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cloud-init","fixed_in":["22.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cloud-init","fixed_in":["22.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cloud-init","fixed_in":["22.2-2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"cloud-init","fixed_in":["19.4-10.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"cloud-init","fixed_in":["19.4-12.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"cloud-init","fixed_in":["21.4-14.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"cloud-init","fixed_in":["21.4-14.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cloud-init","fixed_in":["22.2-0ubuntu1~18.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"cloud-init","fixed_in":["22.2-0ubuntu1~20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cloud-init","fixed_in":["22.2-0ubuntu1~22.04.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cloud-init","fixed_in":["23.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1-10.el9.alma.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1-10.el9_2.alma.tuxcare.els5"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2-2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.4-10.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.4-12.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.4-14.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.4-14.oe2203sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.1-150100.8.63.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.1-150100.8.63.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.1-150100.8.63.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.1-150100.8.63.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.1-150100.8.63.5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.1-150100.8.63.5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.1-150100.8.63.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2-0ubuntu1~18.04.3"}]}],"versions":["17.1-18-gd4f70470-0ubuntu1","17.1-25-g17a15f9e-0ubuntu1~17.10.1","17.1-25-g17a15f9e-0ubuntu1","17.1-27-geb292c18-0ubuntu1","17.1-41-g76243487-0ubuntu1","17.1-46-g7acc9e68-0ubuntu1","17.1-51-g05b2308a-0ubuntu1","17.1-53-ga5dc0f42-0ubuntu1","17.1-58-g703241a3-0ubuntu1","17.1-60-ga30a3bb5-0ubuntu1","17.2-1-g4089e20c-0ubuntu1","17.2-9-gdf24daa8-0ubuntu1","17.2-13-g6299e8d0-0ubuntu1","17.2-20-g32a6a176-0ubuntu1","17.2-25-gc03bdd3d-0ubuntu1","17.2-30-gf7deaf15-0ubuntu1","17.2-34-g644048e3-0ubuntu1","18.1-0ubuntu1","18.1-5-g40e77380-0ubuntu1","18.1-17-g97012fbb-0ubuntu1","18.1-23-gde34dc7c-0ubuntu1","18.1-26-g685f9901-0ubuntu1","18.1-35-ge0f644b7-0ubuntu1","18.1-35-ge0f644b7-0ubuntu2","18.2-0ubuntu1","18.2-4-g05926e48-0ubuntu1","18.2-4-g05926e48-0ubuntu2","18.2-9-g49b562c9-0ubuntu1","18.2-14-g6d48d265-0ubuntu1","18.2-27-g6ef92c98-0ubuntu1~18.04.1","18.3-9-g2e62cb8a-0ubuntu1~18.04.2","18.4-0ubuntu1~18.04.1","18.5-21-g8ee294d5-0ubuntu1~18.04.1","18.5-45-g3554ffe8-0ubuntu1~18.04.1","19.1-1-gbaa47854-0ubuntu1~18.04.1","19.2-24-ge7881d5c-0ubuntu1~18.04.1","19.2-36-g059d049c-0ubuntu1~18.04.1","19.2-36-g059d049c-0ubuntu2~18.04.1","19.3-41-gc4735dd3-0ubuntu1~18.04.1","19.4-33-gbb4131a2-0ubuntu1~18.04.1","20.2-45-g5f7825e2-0ubuntu1~18.04.1","20.3-2-g371b392c-0ubuntu1~18.04.1","20.4-0ubuntu1~18.04.1","20.4-0ubuntu1~18.04.2","20.4.1-0ubuntu1~18.04.1","21.1-19-gbad84ad4-0ubuntu1~18.04.1","21.1-19-gbad84ad4-0ubuntu1~18.04.2","21.2-3-g899bfaa9-0ubuntu2~18.04.1","21.3-1-g6803368d-0ubuntu1~18.04.3","21.3-1-g6803368d-0ubuntu1~18.04.4","21.4-0ubuntu1~18.04.1","22.1-14-g2e17a0d6-0ubuntu1~18.04.2","22.1-14-g2e17a0d6-0ubuntu1~18.04.3","22.2-0ubuntu1~18.04.1","22.2-0ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2-0ubuntu1~20.04.3"}]}],"versions":["19.2-36-g059d049c-0ubuntu3","19.2-78-ge8138959-0ubuntu1","19.3-0ubuntu1","19.3-23-gfb04493e-0ubuntu1","19.3-30-g4bc399e0-0ubuntu1","19.3-40-gf69d33a7-0ubuntu1","19.3-41-gc4735dd3-0ubuntu1","19.3-74-g129b1c4e-0ubuntu1","19.4-1-g8c96cbc1-0ubuntu1","19.4-16-gf8950d63-0ubuntu1","19.4-31-g3f6192b3-0ubuntu1","19.4-33-gbb4131a2-0ubuntu1","19.4-56-g06e324ff-0ubuntu1","20.1-0ubuntu1","20.1-5-g67c8e53c-0ubuntu1","20.1-9-g1f860e5a-0ubuntu1","20.1-10-g71af48df-0ubuntu1","20.1-10-g71af48df-0ubuntu2","20.1-10-g71af48df-0ubuntu3","20.1-10-g71af48df-0ubuntu5","20.2-45-g5f7825e2-0ubuntu1~20.04.1","20.3-2-g371b392c-0ubuntu1~20.04.1","20.4-0ubuntu1~20.04.1","20.4-0ubuntu1~20.04.2","20.4.1-0ubuntu1~20.04.1","21.1-19-gbad84ad4-0ubuntu1~20.04.1","21.1-19-gbad84ad4-0ubuntu1~20.04.2","21.2-3-g899bfaa9-0ubuntu2~20.04.1","21.3-1-g6803368d-0ubuntu1~20.04.3","21.3-1-g6803368d-0ubuntu1~20.04.4","21.4-0ubuntu1~20.04.1","22.1-14-g2e17a0d6-0ubuntu1~20.04.2","22.1-14-g2e17a0d6-0ubuntu1~20.04.3","22.2-0ubuntu1~20.04.1","22.2-0ubuntu1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2-0ubuntu1~22.04.3"}]}],"versions":["21.3-1-g6803368d-0ubuntu3","21.4-0ubuntu1~22.04.1","21.4-25-g039c40f9-0ubuntu1~22.04.1","21.4-119-gdeb3ae82-0ubuntu1~22.04.1","21.4-119-gdeb3ae82-0ubuntu1~22.04.2","22.1-1-gb3d9acdd-0ubuntu1~22.04.1","22.1-14-g2e17a0d6-0ubuntu1~22.04.1","22.1-14-g2e17a0d6-0ubuntu1~22.04.2","22.1-14-g2e17a0d6-0ubuntu1~22.04.3","22.1-14-g2e17a0d6-0ubuntu1~22.04.4","22.1-14-g2e17a0d6-0ubuntu1~22.04.5","22.2-0ubuntu1~22.04.1","22.2-0ubuntu1~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2-0ubuntu1~18.04.3"}]}],"versions":["17.1-18-gd4f70470-0ubuntu1","17.1-25-g17a15f9e-0ubuntu1~17.10.1","17.1-25-g17a15f9e-0ubuntu1","17.1-27-geb292c18-0ubuntu1","17.1-41-g76243487-0ubuntu1","17.1-46-g7acc9e68-0ubuntu1","17.1-51-g05b2308a-0ubuntu1","17.1-53-ga5dc0f42-0ubuntu1","17.1-58-g703241a3-0ubuntu1","17.1-60-ga30a3bb5-0ubuntu1","17.2-1-g4089e20c-0ubuntu1","17.2-9-gdf24daa8-0ubuntu1","17.2-13-g6299e8d0-0ubuntu1","17.2-20-g32a6a176-0ubuntu1","17.2-25-gc03bdd3d-0ubuntu1","17.2-30-gf7deaf15-0ubuntu1","17.2-34-g644048e3-0ubuntu1","18.1-0ubuntu1","18.1-5-g40e77380-0ubuntu1","18.1-17-g97012fbb-0ubuntu1","18.1-23-gde34dc7c-0ubuntu1","18.1-26-g685f9901-0ubuntu1","18.1-35-ge0f644b7-0ubuntu1","18.1-35-ge0f644b7-0ubuntu2","18.2-0ubuntu1","18.2-4-g05926e48-0ubuntu1","18.2-4-g05926e48-0ubuntu2","18.2-9-g49b562c9-0ubuntu1","18.2-14-g6d48d265-0ubuntu1","18.2-27-g6ef92c98-0ubuntu1~18.04.1","18.3-9-g2e62cb8a-0ubuntu1~18.04.2","18.4-0ubuntu1~18.04.1","18.5-21-g8ee294d5-0ubuntu1~18.04.1","18.5-45-g3554ffe8-0ubuntu1~18.04.1","19.1-1-gbaa47854-0ubuntu1~18.04.1","19.2-24-ge7881d5c-0ubuntu1~18.04.1","19.2-36-g059d049c-0ubuntu1~18.04.1","19.2-36-g059d049c-0ubuntu2~18.04.1","19.3-41-gc4735dd3-0ubuntu1~18.04.1","19.4-33-gbb4131a2-0ubuntu1~18.04.1","20.2-45-g5f7825e2-0ubuntu1~18.04.1","20.3-2-g371b392c-0ubuntu1~18.04.1","20.4-0ubuntu1~18.04.1","20.4-0ubuntu1~18.04.2","20.4.1-0ubuntu1~18.04.1","21.1-19-gbad84ad4-0ubuntu1~18.04.1","21.1-19-gbad84ad4-0ubuntu1~18.04.2","21.2-3-g899bfaa9-0ubuntu2~18.04.1","21.3-1-g6803368d-0ubuntu1~18.04.3","21.3-1-g6803368d-0ubuntu1~18.04.4","21.4-0ubuntu1~18.04.1","22.1-14-g2e17a0d6-0ubuntu1~18.04.2","22.1-14-g2e17a0d6-0ubuntu1~18.04.3","22.2-0ubuntu1~18.04.1","22.2-0ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2-0ubuntu1~20.04.3"}]}],"versions":["19.2-36-g059d049c-0ubuntu3","19.2-78-ge8138959-0ubuntu1","19.3-0ubuntu1","19.3-23-gfb04493e-0ubuntu1","19.3-30-g4bc399e0-0ubuntu1","19.3-40-gf69d33a7-0ubuntu1","19.3-41-gc4735dd3-0ubuntu1","19.3-74-g129b1c4e-0ubuntu1","19.4-1-g8c96cbc1-0ubuntu1","19.4-16-gf8950d63-0ubuntu1","19.4-31-g3f6192b3-0ubuntu1","19.4-33-gbb4131a2-0ubuntu1","19.4-56-g06e324ff-0ubuntu1","20.1-0ubuntu1","20.1-5-g67c8e53c-0ubuntu1","20.1-9-g1f860e5a-0ubuntu1","20.1-10-g71af48df-0ubuntu1","20.1-10-g71af48df-0ubuntu2","20.1-10-g71af48df-0ubuntu3","20.1-10-g71af48df-0ubuntu5","20.2-45-g5f7825e2-0ubuntu1~20.04.1","20.3-2-g371b392c-0ubuntu1~20.04.1","20.4-0ubuntu1~20.04.1","20.4-0ubuntu1~20.04.2","20.4.1-0ubuntu1~20.04.1","21.1-19-gbad84ad4-0ubuntu1~20.04.1","21.1-19-gbad84ad4-0ubuntu1~20.04.2","21.2-3-g899bfaa9-0ubuntu2~20.04.1","21.3-1-g6803368d-0ubuntu1~20.04.3","21.3-1-g6803368d-0ubuntu1~20.04.4","21.4-0ubuntu1~20.04.1","22.1-14-g2e17a0d6-0ubuntu1~20.04.2","22.1-14-g2e17a0d6-0ubuntu1~20.04.3","22.2-0ubuntu1~20.04.1","22.2-0ubuntu1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2-0ubuntu1~22.04.3"}]}],"versions":["21.3-1-g6803368d-0ubuntu3","21.4-0ubuntu1~22.04.1","21.4-25-g039c40f9-0ubuntu1~22.04.1","21.4-119-gdeb3ae82-0ubuntu1~22.04.1","21.4-119-gdeb3ae82-0ubuntu1~22.04.2","22.1-1-gb3d9acdd-0ubuntu1~22.04.1","22.1-14-g2e17a0d6-0ubuntu1~22.04.1","22.1-14-g2e17a0d6-0ubuntu1~22.04.2","22.1-14-g2e17a0d6-0ubuntu1~22.04.3","22.1-14-g2e17a0d6-0ubuntu1~22.04.4","22.1-14-g2e17a0d6-0ubuntu1~22.04.5","22.2-0ubuntu1~22.04.1","22.2-0ubuntu1~22.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cloud-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.1-1.1"}]}]}],"products":[{"vendor":"canonical","product":"cloud-init"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"canonical ltd.","product":"cloud-init"}],"references":[{"url":"https://github.com/canonical/cloud-init/commit/4d467b14363d800b2185b89790d57871f11ea88c","tags":["patch","x_transferred","Patch","fix"]},{"url":"https://ubuntu.com/security/notices/USN-5496-1","tags":["vendor-advisory","x_transferred","Broken Link","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2084","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w62x-qh57-5m94"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-2084","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-2084","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782809708.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791533950.html","tags":["advisory"]},{"url":"https://github.com/canonical/cloud-init/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2084.json","tags":["advisory"]},{"url":"https://github.com/canonical/cloud-init/releases","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2084","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1290","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171511","tags":["report"]},{"url":"https://bugzilla.suse.com/1203393","tags":["report"]},{"url":"https://bugzilla.suse.com/1210277","tags":["report"]},{"url":"https://bugzilla.suse.com/1210652","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1786","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-2084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2084","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-2084","title":"sensitive data exposure in cloud-init logs","description":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.","status":"published","published":"2023-04-19T21:47:41.034Z","modified":"2025-02-05T14:42:29.207Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-532","CWE-532"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-34374","description":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.","status":"published","published":"2023-04-19T21:47:41Z","modified":"2025-02-05T14:42:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:05.565654Z"}],"ghsa":[{"id":"GHSA-w62x-qh57-5m94","title":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when...","description":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.","status":"published","published":"2023-04-20T00:30:43Z","modified":"2024-04-04T03:36:28Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:56:16.439649Z"}],"nvd":[{"id":"CVE-2022-2084","description":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.","status":"published","published":"2023-04-19T22:15:10.207Z","modified":"2026-06-17T04:41:15.157Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:07:37.42466Z"}],"osv":[{"id":"ALPINE-CVE-2022-2084","description":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.","status":"published","published":"2023-04-19T22:15:10.207Z","modified":"2026-11-03T07:30:12.890686218Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"BELL-CVE-2022-2084","title":"CVE-2022-2084 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:17.616624Z","modified":"2026-01-26T09:49:02.801831Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2022-2084","title":"sensitive data exposure in cloud-init logs","description":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.","status":"published","published":"2023-04-19T21:47:41.034Z","modified":"2026-10-28T02:30:57.057586715Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-2084","description":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.","status":"published","published":"2023-04-19T22:15:10.207Z","modified":"2026-11-03T08:02:10.375841727Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2023-1290","title":"cloud-init security update","description":"Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance.\r\n\r\nSecurity Fix(es):\r\n\r\nSensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.(CVE-2022-2084)","status":"published","published":"2023-05-19T11:05:45Z","modified":"2026-08-18T01:17:41.000071656Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2022-2084","description":"Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.","status":"published","published":"2022-06-29T21:00:00Z","modified":"2026-02-04T03:36:52.345963Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"CLSA-2026-1782809708","title":"cloud-init: Fix of CVE-2022-2084","description":"- CVE-2022-2084: remove schema errors from log to avoid leaking sensitive\n  user-data values into world-readable /var/log/cloud-init.log","status":"published","published":"2026-06-30T08:55:24Z","modified":"2026-10-26T09:30:23.300556361Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1791533950","title":"cloud-init: Fix of 4 CVEs","description":"- CVE-2024-6174: fix platform enumeration by changing default policy of\n  ds-identify to disallow discovery of datasources without strict identifiable\n- CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent\n  unprivileged user from triggering hotplug-hook commands\n- CVE-2023-1786: fix leak of sensitive user/vendor data and enforce 640 perms on\n  cloud-init.log\n- CVE-2022-2084: remove schema errors from log to avoid leaking sensitive\n  user-data values into world-readable /var/log/cloud-init.log\n- rebuild with the vendor .el9_2 dist so the update outranks AlmaLinux\n  22.1-10.el9_2.alma","status":"published","published":"2026-10-09T08:19:17Z","modified":"2026-10-26T09:43:36.084673543Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"openSUSE-SU-2024:12738-1","title":"cloud-init-23.1-1.1 on GA media","description":"These are all security issues fixed in the cloud-init-23.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:16:11.796684Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:2628-1","title":"Security update for cloud-init","description":"This update for cloud-init fixes the following issues:\n\n- CVE-2023-1786: Do not expose sensitive data gathered from the CSP. (bsc#1210277)\n- CVE-2022-2084: Fixed a bug which caused logging schema failures can include password hashes. (bsc#1210652)\n    \n- Update to version 23.1\n\n  + Support transactional-updates for SUSE based distros\n  + Set ownership for new folders in Write Files Module\n  + add OpenCloudOS and TencentOS support\n  + lxd: Retry if the server isn't ready \n  + test: switch pycloudlib source to pypi \n  + test: Fix integration test deprecation message \n  + Recognize opensuse-microos, dev tooling fixes \n  + sources/azure: refactor imds handler into own module \n  + docs: deprecation generation support \n  + add function is_virtual to distro/FreeBSD\n  + cc_ssh: support multiple hostcertificates \n  + Fix minor schema validation regression and fixup typing \n  + doc: Reword user data debug section \n  + cli: schema also validate vendordata*.\n  + ci: sort and add checks for cla signers file \n  + Add 'ederst' as contributor\n  + readme: add reference to packages dir \n  + docs: update downstream package list \n  + docs: add google search verification \n  + docs: fix 404 render use default notfound_urls_prefix in RTD conf\n  + Fix OpenStack datasource detection on bare metal\n  + docs: add themed RTD 404 page and pointer to readthedocs-hosted \n  + schema: fix gpt labels, use type string for GUID \n  + cc_disk_setup: code cleanup \n  + netplan: keep custom strict perms when 50-cloud-init.yaml exists\n  + cloud-id: better handling of change in datasource files\n  + Warn on empty network key \n  + Fix Vultr cloud_interfaces usage \n  + cc_puppet: Update puppet service name \n  + docs: Clarify networking docs \n  + lint: remove httpretty \n  + cc_set_passwords: Prevent traceback when restarting ssh \n  + tests: fix lp1912844 \n  + tests: Skip ansible test on bionic \n  + Wait for NetworkManager \n  + docs: minor polishing \n  + CI: migrate integration-test to GH actions \n  + Fix permission of SSH host keys \n  + Fix default route rendering on v2 ipv6\n  + doc: fix path in net_convert command \n  + docs: update net_convert docs\n  + doc: fix dead link\n  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty\n  + distros/rhel.py: _read_hostname() missing strip on 'hostname'\n  + integration tests: add  IBM VPC support \n  + machine-id: set to uninitialized to trigger regeneration on clones\n  + sources/azure: retry on connection error when fetching metdata \n  + Ensure ssh state accurately obtained \n  + bddeb: drop dh-systemd dependency on newer deb-based releases \n  + doc: fix `config formats` link in cloudsigma.rst \n  + Fix wrong subp syntax in cc_set_passwords.py \n  + docs: update the PR template link to readthedocs \n  + ci: switch unittests to gh actions\n  + Add mount_default_fields for PhotonOS. \n  + sources/azure: minor refactor for metadata source detection logic\n  + add 'CalvoM' as contributor \n  + ci: doc to gh actions \n  + lxd: handle 404 from missing devices route for LXD 4.0 \n  + docs: Diataxis overhaul \n  + vultr: Fix issue regarding cache and region codes \n  + cc_set_passwords: Move ssh status checking later \n  + Improve Wireguard module idempotency \n  + network/netplan: add gateways as on-link when necessary \n  + tests: test_lxd assert features.networks.zones when present \n  + Use btrfs enquque when available (#1926) [Robert Schweikert]\n  + sources/azure: fix device driver matching for net config (#1914)\n  + BSD: fix duplicate macs in Ifconfig parser \n  + pycloudlib: add lunar support for integration tests \n  + nocloud: add support for dmi variable expansion for seedfrom URL\n  + tools: read-version drop extra call to git describe --long\n  + doc: improve cc_write_files doc\n  + read-version: When insufficient tags, use cloudinit.version.get_version\n  + mounts: document weird prefix in schema \n  + Ensure network ready before cloud-init service runs on RHEL\n  + docs: add copy button to code blocks \n  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag\n  + azure: fix support for systems without az command installed \n  + Fix the distro.osfamily output problem in the openEuler system. \n  + pycloudlib: bump commit dropping azure api smoke test\n  + net: netplan config root read-only as wifi config can contain creds\n  + autoinstall: clarify docs for users\n  + sources/azure: encode health report as utf-8 \n  + Add back gateway4/6 deprecation to docs \n  + networkd: Add support for multiple [Route] sections \n  + doc: add qemu tutorial \n  + lint: fix tip-flake8 and tip-mypy \n  + Add support for setting uid when creating users on FreeBSD \n  + Fix exception in BSD networking code-path \n  + Append derivatives to is_rhel list in cloud.cfg.tmpl \n  + FreeBSD init: use cloudinit_enable as only rcvar \n  + feat: add support aliyun metadata security harden mode \n  + docs: uprate analyze to performance page\n  + test: fix lxd preseed managed network config \n  + Add support for static IPv6 addresses for FreeBSD \n  + Make 3.12 failures not fail the build \n  + Docs: adding relative links \n  + Fix setup.py to align with PEP 440 versioning replacing trailing\n  + Add 'nkukard' as contributor \n  + doc: add how to render new module doc \n  + doc: improve module creation explanation \n  + Add Support for IPv6 metadata to OpenStack \n  + add xiaoge1001 to .github-cla-signers\n  + network: Deprecate gateway{4,6} keys in network config v2\n  + VMware: Move Guest Customization transport from OVF to VMware\n  + doc: home page links added\n  + net: skip duplicate mac check for netvsc nic and its VF\n\nThis update for python-responses fixes the following issues:\n  \n- update to 0.21.0:\n  * Add `threading.Lock()` to allow `responses` working with `threading` module.\n  * Add `urllib3` `Retry` mechanism. See #135\n  * Removed internal `_cookies_from_headers` function\n  * Now `add`, `upsert`, `replace` methods return registered response.\n    `remove` method returns list of removed responses.\n  * Added null value support in `urlencoded_params_matcher` via `allow_blank` keyword argument\n  * Added strict version of decorator. Now you can apply `@responses.activate(assert_all_requests_are_fired=True)`\n    to your function to validate that all requests were executed in the wrapped function. See #183\n\n  \n","status":"published","published":"2023-06-23T19:44:04Z","modified":"2026-02-04T04:15:51.879081Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-5496-1","title":"cloud-init vulnerability","description":"Mike Stroyan discovered that cloud-init could log password hashes when\nreporting schema failures. An attacker with access to these logs could\npotentially use this to gain user credentials.\n","status":"published","published":"2022-06-29T22:11:21Z","modified":"2026-02-10T04:42:40Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}