Search
Find a vulnerability
Search criteria
1 vulnerability found for Subiquity by Canonical
CVE-2020-11932 (GCVE-0-2020-11932)
Vulnerability from cvelistv5 – Published: 2020-05-13 00:20 – Updated: 2024-09-16 23:05
VLAI
EPSS
VEX
Title
Subiquity server installer logged LUKS full disk encryption password
Summary
It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
Severity
CWE
- CWE-532 - Information Exposure Through Log Files
Assigner
canonical
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/CanonicalLtd/subiquity/commit/… | x_refsource_MISC |
| https://aliceandbob.company/the-human-factor-in-a… | x_refsource_MISC |
Impacted products
Date Public
2020-05-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:42:00.812Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/CanonicalLtd/subiquity/commit/7db70650feaf513d7fb6f1ca07f2d670a0890613"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://aliceandbob.company/the-human-factor-in-an-economy-of-scale/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Subiquity",
"vendor": "Canonical",
"versions": [
{
"lessThan": "20.05.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Moritz Naumann from Alice\u0026Bob.Company GmbH"
}
],
"datePublic": "2020-05-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Information Exposure Through Log Files",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-03T17:03:51.000Z",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/CanonicalLtd/subiquity/commit/7db70650feaf513d7fb6f1ca07f2d670a0890613"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://aliceandbob.company/the-human-factor-in-an-economy-of-scale/"
}
],
"source": {
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/subiquity/+bug/1878115"
],
"discovery": "USER"
},
"title": "Subiquity server installer logged LUKS full disk encryption password",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@ubuntu.com",
"DATE_PUBLIC": "2020-05-11T00:00:00.000Z",
"ID": "CVE-2020-11932",
"STATE": "PUBLIC",
"TITLE": "Subiquity server installer logged LUKS full disk encryption password"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Subiquity",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "20.05.2"
}
]
}
}
]
},
"vendor_name": "Canonical"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Moritz Naumann from Alice\u0026Bob.Company GmbH"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-532 Information Exposure Through Log Files"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/CanonicalLtd/subiquity/commit/7db70650feaf513d7fb6f1ca07f2d670a0890613",
"refsource": "MISC",
"url": "https://github.com/CanonicalLtd/subiquity/commit/7db70650feaf513d7fb6f1ca07f2d670a0890613"
},
{
"name": "https://aliceandbob.company/the-human-factor-in-an-economy-of-scale/",
"refsource": "MISC",
"url": "https://aliceandbob.company/the-human-factor-in-an-economy-of-scale/"
}
]
},
"source": {
"defect": [
"https://bugs.launchpad.net/ubuntu/+source/subiquity/+bug/1878115"
],
"discovery": "USER"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2020-11932",
"datePublished": "2020-05-13T00:20:13.011Z",
"dateReserved": "2020-04-20T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:05:48.869Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}