CVE-2022-2084 (Python, published 2023-04-19T22:15Z)
Description: value: Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/canonical/cloud-init
Files changed:
cloudinit/cmd/main.py
cloudinit/config/schema.py
tests/integration_tests/modules/test_cli.py
tests/unittests/config/test_schema.py
Commit message: Remove schema errors from log (#1551)

When schema errors are encountered, the section of userdata in question
gets printed to the cloud-init log. As this could contain sensitive
data, so log a generic warning instead and redirect user to run
cloud-init schema --system as root.

LP: #1978422
CVE: 2022-2084

Vulnerable code:
        validate_cloudconfig_schema(config=init.cfg, strict=False)
        else:
            LOG.warning(
                "Invalid cloud-config provided:\n%s", "\n".join(messages)
updates:
 notnetwork: -1
apt_pipelining: bogus
        "[WARNING]: Invalid cloud-config provided:\napt_pipelining: 'bogus'"
        " is not valid under any of the given schemas\nupdates: Additional"
        " properties are not allowed ('notnetwork' was unexpected)"
            "Invalid cloud-config provided:\np1: -1 is not of type 'string'"

Fixed code:
        validate_cloudconfig_schema(
            config=init.cfg, strict=False, log_details=False
        )
    log_details: bool = True,
    @param log_details: Boolean, when True logs details of validation errors.
       If there are concerns about logging sensitive userdata, this should
       be set to False.
            # This could output/log sensitive data
        if log_details:
            details = "\n" + "\n".join(messages)
        else:
            details = (
                "Please run 'sudo cloud-init schema --system' to "
                "see the schema errors."
        LOG.warning("Invalid cloud-config provided: %s", details)
# The '-' in 'hashed-password' fails schema validation
users:
  - default
  - name: newsuper
    gecos: Big Stuff
    groups: users, admin
    sudo: ALL=(ALL) NOPASSWD:ALL
    hashed-password: asdfasdf
    shell: /bin/bash
    lock_passwd: true
        "[WARNING]: Invalid cloud-config provided: Please run "
        "'sudo cloud-init schema --system' to see the schema errors."
    assert "asdfasdf" not in log

            "Invalid cloud-config provided: \np1: -1 is not of type 'string'"
    @skipUnlessJsonSchema()
    def test_validateconfig_schema_sensitive(self, caplog):
        """When log_details=False, ensure details are omitted"""
        schema = {
            "properties": {"hashed_password": {"type": "string"}},
            "additionalProperties": False,
        }
        validate_cloudconfig_schema(
            {"hashed-password": "secret"},
            schema,
            strict=False,
            log_details=False,
        )
        [(module, log_level, log_msg)] = caplog.record_tuples
        assert "cloudinit.config.schema" == module
        assert logging.WARNING == log_level
        assert (
            "Invalid cloud-config provided: Please run 'sudo cloud-init "
            "schema --system' to see the schema errors." == log_msg
        )