CL
Product
cloud-init
9
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 6Low 0
Watch
Add cloud-init to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-1786 | 5.5 | Apr 26 | Sensitive data could be exposed in logs of cloud-init before version 23.1.2 Affected: before 23.1.2 |
| CVE-2022-2084 | 5.5 | Apr 19 | Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported Affected: before 22.3 |
| CVE-2021-3429 | 5.5 | Apr 19 | When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file… Affected: before 21.2 |
| CVE-2020-8632 | 5.5 | Feb 5 | In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords Affected: through 19.4 |
| CVE-2020-8631 | 5.5 | Feb 5 | cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the… Affected: through 19.4 |
| CVE-2024-11584 | 5.3 | Jun 26 | cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used… Affected: before 25.1.3 |
Showing 6