When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2164-1 advisory.

  - When instructing cloud-init to set a random password for a new user account, versions before 21.2 would     write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a     local user to log in as another user. (CVE-2021-3429)

  - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this     information to find hashed passwords and possibly escalate their privilege. (CVE-2023-1786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - When instructing cloud-init to set a random password for a new user account, versions before 21.2 would     write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a     local user to log in as another user. (CVE-2021-3429)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2021:3081 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When instructing cloud-init to set a random password for a new user account, versions before 21.2 would     write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a     local user to log in as another user. (CVE-2021-3429)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3371 advisory.

  - cloud-init: randomly generated passwords logged in clear-text to world-readable file (CVE-2021-3429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3177 advisory.

  - cloud-init: randomly generated passwords logged in clear-text to world-readable file (CVE-2021-3429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3081 advisory.

  - cloud-init: randomly generated passwords logged in clear-text to world-readable file (CVE-2021-3429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-3081 advisory.

    - Resolves: bz#1979252       (CVE-2021-3429 cloud-init: randomly generated passwords logged in clear-text to world-readable file     [rhel-8] [rhel-8.4.0.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3081 advisory.

  - cloud-init: randomly generated passwords logged in clear-text to world-readable file (CVE-2021-3429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

cloud-init has the ability to generate and set a randomized password for system users. This functionality is enabled at runtime by passing cloud-config data such as :

chpasswd: list: | user1:RANDOM

When used this way, cloud-init logs the raw, unhashed password to a world-readable local file.

For Debian 9 stretch, this problem has been fixed in version 0.7.9-2+deb9u1.

We recommend that you upgrade your cloud-init packages.

For the detailed security status of cloud-init please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/cloud-init

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of cloud-init installed on the remote host is prior to 0.7.6-43.23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1486 advisory.

  - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for     attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
    (CVE-2020-8631)

  - In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default     pwlen value, which makes it easier for attackers to guess passwords. (CVE-2020-8632)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote host is prior to 19.3-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1620 advisory.

  - A vulnerability was discovered in cloud-init which can improperly disclose randomly generated passwords as     part of the chpasswd module. The fix prevents the generated password from being written to a world-     readable log file on the local disk. (CVE-2021-3429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
175592	SUSE SLES12 Security Update : cloud-init (SUSE-SU-2023:2164-1)	Nessus	SuSE Local Security Checks	medium
157983	EulerOS Virtualization 3.0.6.0 : cloud-init (EulerOS-SA-2022-1058)	Nessus	Huawei Local Security Checks	medium
157784	Rocky Linux 8 : cloud-init (RLSA-2021:3081)	Nessus	Rocky Linux Local Security Checks	medium
155260	EulerOS 2.0 SP9 : cloud-init (EulerOS-SA-2021-2680)	Nessus	Huawei Local Security Checks	medium
155236	EulerOS 2.0 SP9 : cloud-init (EulerOS-SA-2021-2705)	Nessus	Huawei Local Security Checks	medium
154795	EulerOS 2.0 SP8 : cloud-init (EulerOS-SA-2021-2624)	Nessus	Huawei Local Security Checks	medium
152933	RHEL 8 : cloud-init (RHSA-2021:3371)	Nessus	Red Hat Local Security Checks	medium
152620	RHEL 8 : cloud-init (RHSA-2021:3177)	Nessus	Red Hat Local Security Checks	medium
152572	CentOS 8 : cloud-init (CESA-2021:3081)	Nessus	CentOS Local Security Checks	medium
152510	Oracle Linux 8 : cloud-init (ELSA-2021-3081)	Nessus	Oracle Linux Local Security Checks	medium
152442	RHEL 8 : cloud-init (RHSA-2021:3081)	Nessus	Red Hat Local Security Checks	medium
147928	Debian DLA-2601-1 : cloud-init security update	Nessus	Debian Local Security Checks	medium
147917	Amazon Linux AMI : cloud-init (ALAS-2021-1486)	Nessus	Amazon Linux Local Security Checks	medium
147907	Amazon Linux 2 : cloud-init (ALAS-2021-1620)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2021-3429

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium