Security update for cloud-init SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2164-1 Final 1 1 2023-05-10T17:55:46Z current 2023-05-10T17:55:46Z 2023-05-10T17:55:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for cloud-init This update for cloud-init contains following fixes: - CVE-2021-3429: Do not write the generated password to the log file. (bsc#1184758) - CVE-2023-1786: Do not expose sensitive data gathered from the CSP. (bsc#1210277) Other fixes: - Change log file creation mode to 640. (bsc#1183939) - Write proper bonding option configuration for SLE/openSUSE. (bsc#1184085) - Do not including sudoers.d directory twice. (bsc#1181283) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-BYOS-2023-2164,Image SLES12-SP5-Azure-Basic-On-Demand-2023-2164,Image SLES12-SP5-Azure-HPC-BYOS-2023-2164,Image SLES12-SP5-Azure-HPC-On-Demand-2023-2164,Image SLES12-SP5-Azure-SAP-BYOS-2023-2164,Image SLES12-SP5-Azure-SAP-On-Demand-2023-2164,Image SLES12-SP5-Azure-Standard-On-Demand-2023-2164,Image SLES12-SP5-EC2-BYOS-2023-2164,Image SLES12-SP5-EC2-ECS-On-Demand-2023-2164,Image SLES12-SP5-EC2-On-Demand-2023-2164,Image SLES12-SP5-EC2-SAP-BYOS-2023-2164,Image SLES12-SP5-EC2-SAP-On-Demand-2023-2164,SUSE-2023-2164,SUSE-SLE-Module-Public-Cloud-12-2023-2164 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232164-1/ Link for SUSE-SU-2023:2164-1 https://lists.suse.com/pipermail/sle-updates/2023-May/029326.html E-Mail link for SUSE-SU-2023:2164-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1181283 SUSE Bug 1181283 https://bugzilla.suse.com/1183939 SUSE Bug 1183939 https://bugzilla.suse.com/1184085 SUSE Bug 1184085 https://bugzilla.suse.com/1184758 SUSE Bug 1184758 https://bugzilla.suse.com/1210277 SUSE Bug 1210277 https://www.suse.com/security/cve/CVE-2021-3429/ SUSE CVE CVE-2021-3429 page https://www.suse.com/security/cve/CVE-2023-1786/ SUSE CVE CVE-2023-1786 page Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand SUSE Linux Enterprise Module for Public Cloud 12 cloud-init-20.2-37.57.1 cloud-init-config-suse-20.2-37.57.1 cloud-init-doc-20.2-37.57.1 cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-BYOS cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-BYOS cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-BYOS cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-BYOS cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-On-Demand cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-On-Demand cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS cloud-init-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand cloud-init-config-suse-20.2-37.57.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand cloud-init-20.2-37.57.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 cloud-init-config-suse-20.2-37.57.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user. CVE-2021-3429 Image SLES12-SP5-Azure-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-Basic-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-Basic-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-HPC-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-HPC-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-HPC-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-HPC-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-SAP-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-SAP-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-SAP-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-SAP-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-Standard-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-Standard-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-ECS-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-ECS-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-SAP-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-SAP-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-SAP-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-SAP-On-Demand:cloud-init-config-suse-20.2-37.57.1 SUSE Linux Enterprise Module for Public Cloud 12:cloud-init-20.2-37.57.1 SUSE Linux Enterprise Module for Public Cloud 12:cloud-init-config-suse-20.2-37.57.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232164-1/ https://www.suse.com/security/cve/CVE-2021-3429.html CVE-2021-3429 https://bugzilla.suse.com/1184758 SUSE Bug 1184758 Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. CVE-2023-1786 Image SLES12-SP5-Azure-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-Basic-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-Basic-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-HPC-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-HPC-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-HPC-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-HPC-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-SAP-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-SAP-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-SAP-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-SAP-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-Azure-Standard-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-Azure-Standard-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-ECS-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-ECS-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-On-Demand:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-SAP-BYOS:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-SAP-BYOS:cloud-init-config-suse-20.2-37.57.1 Image SLES12-SP5-EC2-SAP-On-Demand:cloud-init-20.2-37.57.1 Image SLES12-SP5-EC2-SAP-On-Demand:cloud-init-config-suse-20.2-37.57.1 SUSE Linux Enterprise Module for Public Cloud 12:cloud-init-20.2-37.57.1 SUSE Linux Enterprise Module for Public Cloud 12:cloud-init-config-suse-20.2-37.57.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232164-1/ https://www.suse.com/security/cve/CVE-2023-1786.html CVE-2023-1786 https://bugzilla.suse.com/1210277 SUSE Bug 1210277