CVE-2023-1786

Public on 2023-04-26

Modified on 2024-02-06

Description

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

Severity

Medium

See what this means

CVSS v3 Base Score

5.5

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory
HAQM Linux 2 - Core	cloud-init	2024-11-15	ALAS2-2024-2701
HAQM Linux 2023	cloud-init	2023-06-07	ALAS2023-2023-196

CVSS Scores

	Score Type	Score	Vector
HAQM Linux	CVSSv3	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	CVSSv3	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Red Hat: CVE-2023-1786 Mitre: CVE-2023-1786 FAQs regarding HAQM Linux ALAS/CVE Severity