{"id":"CVE-2022-4968","aliases":["AZL-51921","AZL-51964","DEBIAN-CVE-2022-4968","EUVD-2022-53922","GHSA-xpvm-9wx5-vjpw","UBUNTU-CVE-2022-4968","USN-6851-1"],"status":"published","title":"netplan leaks the private key of wireguard to local users. A security fix will be released soon.","description":"netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00262,"percentile":0.18116,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-497"],"published":"2024-06-07T00:14:22Z","modified":"2026-10-28T10:25:48Z","fixes":[{"ecosystem":"Azure Linux:3","package":"netplan","fixed_in":["1.0.1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"netplan","fixed_in":["0.95-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"netplan.io","fixed_in":["1.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"netplan.io","fixed_in":["1.0.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"netplan.io","fixed_in":["0.104-0ubuntu2~20.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"netplan.io","fixed_in":["0.106.1-7ubuntu0.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"netplan.io","fixed_in":["1.0-2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"netplan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"netplan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.95-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.106-2","0.106-2+deb12u1","0.106-3","0.106-4~exp1","0.106.1-1","0.106.1-2","0.106.1-3","0.106.1-4","0.106.1-5","0.106.1-6","0.106.1-7","0.106.1-8","0.106.1-8~exp1","0.107-1","0.107-2","0.107-3","0.107-3~exp1","0.107-4","0.107-5","0.107.1-1","0.107.1-2","0.107.1-3","0.107.1-3+exp1","1.0-1","1.0-2","1.0-2.1","1.0-3","1.0-4","1.0-5","1.0-6","1.0-6+exp1","1.0.1-1","1.0.1-2","1.0.1-3","1.1-1","1.1-2","1.1.1-1","1.1.2-1","1.1.2-2","1.1.2-3","1.1.2-4","1.1.2-5","1.1.2-5~exp1","1.1.2-5~exp2","1.1.2-6","1.1.2-7","1.1.2-8","1.2-1","1.2.1-1","1.2.2-1","1.2.2-2","1.2.2-3"]},{"source":"osv","ecosystem":"Debian:13","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.34","0.34.1","0.35","0.36.1","0.36.2","0.36.3","0.40.1~18.04.2","0.40.1~18.04.3","0.40.1~18.04.4","0.96-0ubuntu0.18.04.4","0.97-0ubuntu1~18.04.1","0.98-0ubuntu1~18.04.1","0.99-0ubuntu3~18.04.1","0.99-0ubuntu3~18.04.2","0.99-0ubuntu3~18.04.3","0.99-0ubuntu3~18.04.4","0.99-0ubuntu3~18.04.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.104-0ubuntu2~20.04.5"}]}],"versions":["0.98-0ubuntu1","0.98-0ubuntu2","0.98-0ubuntu3","0.98-0ubuntu4","0.99-0ubuntu1","0.99-0ubuntu2","0.99-0ubuntu3~20.04.1","0.99-0ubuntu3~20.04.2","0.100-0ubuntu4~20.04.2","0.100-0ubuntu4~20.04.3","0.101-0ubuntu3~20.04.2","0.102-0ubuntu1~20.04.1","0.102-0ubuntu1~20.04.2","0.103-0ubuntu5~20.04.1","0.103-0ubuntu5~20.04.2","0.103-0ubuntu5~20.04.3","0.103-0ubuntu5~20.04.5","0.103-0ubuntu5~20.04.6","0.104-0ubuntu2~20.04.1","0.104-0ubuntu2~20.04.2","0.104-0ubuntu2~20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.106.1-7ubuntu0.22.04.3"}]}],"versions":["0.103-0ubuntu7","0.103-0ubuntu8","0.103-0ubuntu9","0.103-0ubuntu10","0.104-0ubuntu1","0.104-0ubuntu2","0.104-0ubuntu2.1","0.105-0ubuntu2~22.04.1","0.105-0ubuntu2~22.04.3","0.106.1-7ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-2ubuntu1.1"}]}],"versions":["0.107-5","0.107-5ubuntu1","0.107-5ubuntu2","0.107.1-3","1.0-1","1.0-2","1.0-2build1","1.0-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.104-0ubuntu2~20.04.5"}]}],"versions":["0.98-0ubuntu1","0.98-0ubuntu2","0.98-0ubuntu3","0.98-0ubuntu4","0.99-0ubuntu1","0.99-0ubuntu2","0.99-0ubuntu3~20.04.1","0.99-0ubuntu3~20.04.2","0.100-0ubuntu4~20.04.2","0.100-0ubuntu4~20.04.3","0.101-0ubuntu3~20.04.2","0.102-0ubuntu1~20.04.1","0.102-0ubuntu1~20.04.2","0.103-0ubuntu5~20.04.1","0.103-0ubuntu5~20.04.2","0.103-0ubuntu5~20.04.3","0.103-0ubuntu5~20.04.5","0.103-0ubuntu5~20.04.6","0.104-0ubuntu2~20.04.1","0.104-0ubuntu2~20.04.2","0.104-0ubuntu2~20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.106.1-7ubuntu0.22.04.3"}]}],"versions":["0.103-0ubuntu7","0.103-0ubuntu8","0.103-0ubuntu9","0.103-0ubuntu10","0.104-0ubuntu1","0.104-0ubuntu2","0.104-0ubuntu2.1","0.105-0ubuntu2~22.04.1","0.105-0ubuntu2~22.04.3","0.106.1-7ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"netplan.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-2ubuntu1.1"}]}],"versions":["0.107-5","0.107-5ubuntu1","0.107-5ubuntu2","0.107.1-3","1.0-1","1.0-2","1.0-2build1","1.0-2ubuntu1"]}],"products":[{"vendor":"canonical","product":"netplan"},{"vendor":"canonical ltd.","product":"netplan"}],"references":[{"url":"https://github.com/canonical/netplan/commit/4c39b75b5c6ae7d976bda6da68da60d9a7f085ee","tags":["patch","x_transferred","Patch","fix"]},{"url":"https://bugs.launchpad.net/netplan/+bug/1987842","tags":["issue-tracking","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/2065738","tags":["issue-tracking","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4968","tags":["issue-tracking","x_transferred","US Government Resource","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4968","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xpvm-9wx5-vjpw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4968.json","tags":["advisory"]},{"url":"https://github.com/canonical/netplan","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-4968","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-4968","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6851-1","tags":["advisory"]},{"url":"https://launchpad.net/bugs/1987842","tags":["report"]},{"url":"https://launchpad.net/bugs/2065738","tags":["report"]},{"url":"https://launchpad.net/bugs/2066258","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-4968","description":"netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.","status":"published","published":"2024-06-07T00:14:22.528Z","modified":"2024-08-03T01:55:46.232Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:34:37.932195Z"}],"euvd":[{"id":"EUVD-2022-53922","description":"netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.","status":"published","published":"2024-06-07T00:14:22Z","modified":"2024-08-03T01:55:46Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:25:55.962721Z"}],"ghsa":[{"id":"GHSA-xpvm-9wx5-vjpw","title":"netplan leaks the private key of wireguard to local users. A security fix will be released soon.","description":"netplan leaks the private key of wireguard to local users. A security fix will be released soon.","status":"published","published":"2024-06-07T03:31:04Z","modified":"2024-06-28T00:33:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-497"],"updated_at":"2026-11-02T14:57:32.670649Z"}],"nvd":[{"id":"CVE-2022-4968","description":"netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.","status":"published","published":"2024-06-07T01:15:49.463Z","modified":"2026-06-17T05:22:26.59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:07:40.49892Z"}],"osv":[{"id":"AZL-51921","title":"CVE-2022-4968 affecting package netplan for versions less than 1.0.1-1","description":"netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.","status":"published","published":"2024-06-07T01:15:49Z","modified":"2026-04-21T04:53:23.491281Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"AZL-51964","title":"CVE-2022-4968 affecting package netplan for versions less than 0.95-3","description":"netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.","status":"published","published":"2024-06-07T01:15:49Z","modified":"2026-04-21T04:33:18.06869Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"CVE-2022-4968","description":"netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.","status":"published","published":"2024-06-07T00:14:22.528Z","modified":"2026-10-28T10:25:48.412412221Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T15:44:28.416025Z"},{"id":"DEBIAN-CVE-2022-4968","description":"netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.","status":"published","published":"2024-06-07T01:15:49.463Z","modified":"2026-11-03T08:03:27.972003853Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:24.826312Z"},{"id":"UBUNTU-CVE-2022-4968","description":"netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected.","status":"published","published":"2024-06-07T01:15:00Z","modified":"2026-04-22T13:44:31.615695Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:03.879901Z"},{"id":"USN-6851-1","title":"netplan.io vulnerabilities","description":"Andreas Hasenack discovered that netplan incorrectly handled the permissions\nfor netdev files containing wireguard configuration. An attacker could use this to obtain\nwireguard secret keys.\n\nIt was discovered that netplan configuration could be manipulated into injecting\narbitrary commands while setting up network interfaces. An attacker could\nuse this to execute arbitrary commands or escalate privileges.\n","status":"published","published":"2024-06-26T13:45:31Z","modified":"2026-04-27T17:17:36.255148Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}