Low severity · published May 13, 2020
CVE-2020-11932
It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered
2.3
CVSS
0.6%
EPSS
No
On KEV
Description
It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
Subiquity · Canonical
before 20.05.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11932
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11932
aliceandbob.company
https://aliceandbob.company/the-human-factor-in-an-economy-of-scale/
Patch
https://github.com/CanonicalLtd/subiquity/commit/7db70650feaf513d7fb6f1ca07f2d670a0890613
More from Subiquity
8.4
CVE-2022-0555
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
5.5
CVE-2023-5182
Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier