远程 Ubuntu 18.04 LTS/20.04 LTS/ 21.10/22.04 LTS 主机上安装的一个程序包受到 USN-5496-1 公告中提及的一个漏洞影响。

  - 在低于 22.3 版的 cloud-init 的全局可读日志中，当报告方案失败时，敏感数据可能会被暴露。此泄漏可能包括经哈希处理的密码。(CVE-2022-2084)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 Ubuntu 18.04 LTS / 20.04 LTS / 21.10 / 22.04 LTS 主機上安裝的一個套件受到 USN-5496-1 公告中提及的一個弱點影響。

  - 在 cloud-init 22.3 之前版本中，報告結構描述失敗時，任何人皆可讀取的記錄檔中可能會洩漏敏感資料。此洩漏可能包括雜湊密碼。(CVE-2022-2084)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートの SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 ホストには、SUSE-SU-2023:2628-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - バージョン 22.3 より前の cloud-init でスキーマ障害が報告された際に、誰でも読み取ることができるログから機密データが漏洩する可能性があります。この漏洩には、ハッシュされたパスワードが含まれる可能性があります。(CVE-2022-2084)

  - バージョン 23.1.2より前の cloud-init のログで、機密データが漏洩する可能性があります。攻撃者がこの情報を使用して、ハッシュされたパスワードを見つけ、権限を昇格する可能性があります。(CVE-2023-1786)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

リモートの Ubuntu 18.04 LTS / 20.04 LTS / 21.10 / 22.04 LTS ホストには、USN-5496-1 のアドバイザリに記載された脆弱性の影響を受けるパッケージがインストールされています。

  - バージョン 22.3 より前の cloud-init でスキーマ障害が報告された際に、誰でも読み取ることができるログから機密データが漏洩する可能性があります。この漏洩には、ハッシュされたパスワードが含まれる可能性があります。(CVE-2022-2084)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote NewStart CGSL host, running version MAIN 7.02, has cloud-init packages installed that are affected by a vulnerability:

  - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema     failures are reported. This leak could include hashed passwords. (CVE-2022-2084)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema     failures are reported. This leak could include hashed passwords. (CVE-2022-2084)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 7.02, has cloud-init packages installed that are affected by multiple vulnerabilities:

  - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema     failures are reported. This leak could include hashed passwords. (CVE-2022-2084)

  - When instructing cloud-init to set a random password for a new user account, versions before 21.2 would     write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a     local user to log in as another user. (CVE-2021-3429)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema     failures are reported. This leak could include hashed passwords. (CVE-2022-2084)

  - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this     information to find hashed passwords and possibly escalate their privilege. (CVE-2023-1786)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2628-1 advisory.

  - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema     failures are reported. This leak could include hashed passwords. (CVE-2022-2084)

  - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this     information to find hashed passwords and possibly escalate their privilege. (CVE-2023-1786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5496-1 advisory.

    Mike Stroyan discovered that cloud-init could log password hashes when reporting schema failures. An     attacker with access to these logs could potentially use this to gain user credentials.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema     failures are reported. This leak could include hashed passwords. (CVE-2022-2084)

  - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this     information to find hashed passwords and possibly escalate their privilege. (CVE-2023-1786)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
162614	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS：cloud-init 漏洞 (USN-5496-1)	Nessus	Ubuntu Local Security Checks	2022/6/29	2024/8/27	medium
162614	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS：cloud-init 弱點 (USN-5496-1)	Nessus	Ubuntu Local Security Checks	2022/6/29	2024/8/27	medium
177615	SUSE SLES15 / openSUSE 15 セキュリティ更新: cloud-init (SUSE-SU-2023:2628-1)	Nessus	SuSE Local Security Checks	2023/6/26	2023/7/14	medium
162614	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : cloud-init の脆弱性 (USN-5496-1)	Nessus	Ubuntu Local Security Checks	2022/6/29	2024/8/27	medium
238020	NewStart CGSL MAIN 7.02 : cloud-init Vulnerability (NS-SA-2025-0074)	Nessus	NewStart CGSL Local Security Checks	2025/6/9	2025/6/18	medium
178387	EulerOS 2.0 SP10 : cloud-init (EulerOS-SA-2023-2375)	Nessus	Huawei Local Security Checks	2023/7/18	2023/7/18	medium
242727	NewStart CGSL MAIN 7.02 : cloud-init Multiple Vulnerabilities (NS-SA-2025-0173)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	medium
188855	EulerOS Virtualization 3.0.6.0 : cloud-init (EulerOS-SA-2023-3422)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
177615	SUSE SLES15 / openSUSE 15 Security Update : cloud-init (SUSE-SU-2023:2628-1)	Nessus	SuSE Local Security Checks	2023/6/26	2023/7/14	medium
162614	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : cloud-init vulnerability (USN-5496-1)	Nessus	Ubuntu Local Security Checks	2022/6/29	2024/8/27	medium
179536	EulerOS 2.0 SP9 : cloud-init (EulerOS-SA-2023-2606)	Nessus	Huawei Local Security Checks	2023/8/8	2023/8/8	medium
179566	EulerOS 2.0 SP9 : cloud-init (EulerOS-SA-2023-2576)	Nessus	Huawei Local Security Checks	2023/8/8	2023/8/8	medium
178371	EulerOS 2.0 SP10 : cloud-init (EulerOS-SA-2023-2349)	Nessus	Huawei Local Security Checks	2023/7/18	2023/7/18	medium
189067	EulerOS 2.0 SP8 : cloud-init (EulerOS-SA-2023-3116)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
188766	EulerOS 2.0 SP11 : cloud-init (EulerOS-SA-2023-2838)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
188843	EulerOS 2.0 SP11 : cloud-init (EulerOS-SA-2023-2855)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium