The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6371 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: sensitive data could be exposed in logs (CVE-2023-1786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:6943 advisory.

  - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this     information to find hashed passwords and possibly escalate their privilege. (CVE-2023-1786)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6042-1 advisory.

    James Golovich discovered that sensitive data could be exposed in logs. An attacker could use this     information to find hashed passwords and possibly escalate their privilege.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c17dde4052 advisory.

    Update to 23.1.2 and fix CVE-2023-1786

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the cloud package has been released.

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema     failures are reported. This leak could include hashed passwords. (CVE-2022-2084)

  - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this     information to find hashed passwords and possibly escalate their privilege. (CVE-2023-1786)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-12298 advisory.

    [22.1-6.0.4.el8_7.2]
    - Fix log file permissions [Orabug: 35302985]

    [22.1-6.0.3.el8_7.2]
    - Fix CVE-2023-1786 [Orabug: 35302985]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6943 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: sensitive data could be exposed in logs (CVE-2023-1786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
185150	RHEL 9 : cloud-init (RHSA-2023:6371)	Nessus	Red Hat Local Security Checks	2023/11/7	2024/11/7	medium
185617	CentOS 8 : cloud-init (CESA-2023:6943)	Nessus	CentOS Local Security Checks	2023/11/14	2023/11/14	medium
174772	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 : Cloud-init vulnerability (USN-6042-1)	Nessus	Ubuntu Local Security Checks	2023/4/26	2024/8/27	medium
175192	Fedora 38 : cloud-init (2023-c17dde4052)	Nessus	Fedora Local Security Checks	2023/5/7	2024/11/15	medium
203999	Photon OS 3.0: Cloud PHSA-2023-3.0-0578	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
188766	EulerOS 2.0 SP11 : cloud-init (EulerOS-SA-2023-2838)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
188843	EulerOS 2.0 SP11 : cloud-init (EulerOS-SA-2023-2855)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
189067	EulerOS 2.0 SP8 : cloud-init (EulerOS-SA-2023-3116)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
174905	Oracle Linux 8 : cloud-init (ELSA-2023-12298)	Nessus	Oracle Linux Local Security Checks	2023/4/27	2024/11/2	medium
185657	RHEL 8 : cloud-init (RHSA-2023:6943)	Nessus	Red Hat Local Security Checks	2023/11/14	2024/11/7	medium
204303	Photon OS 5.0: Cloud PHSA-2023-5.0-0001	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium