PT-2020-12930 · Canonical · Ubuntu Server+1

Moritz Naumann · Published 2020-05-12 · Updated 2020-08-03 · CVE-2020-11932

Positive Technologies (AI Summary)

CVSS v3.1

2.3

Low

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubuntu Server versions prior to Subiquity 20.05.2

Description A security issue was discovered in the Subiquity installer for Ubuntu Server, where the LUKS full disk encryption password was logged if one was entered. This issue was caused by the password being stored in the log. The company Canonical released a corrective version of the Subiquity installer, 20.05.2, which applies to Ubuntu Server installations starting from version 18.04 in Live mode.

Recommendations For Ubuntu Server versions prior to Subiquity 20.05.2, update the Subiquity installer to version 20.05.2, which can be obtained from the Snap Store, to resolve the issue. As a temporary workaround, consider avoiding the use of LUKS full disk encryption or taking extra precautions to protect the password until the update is applied.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2020-11932

Affected Products

Subiquity

Ubuntu Server

References · 17

• 🔥 https://github.com/ProjectorBUg/CVE-2020-11932 · Exploit
• 🔥 https://github.com/Staubgeborener/CVE-2020-11932 · Exploit
• https://github.com/CanonicalLtd/subiquity/commit/7db70650feaf513d7fb6f1ca07f2d670a0890613 · Patch
• https://ubuntu.com/security/CVE-2020-11932 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-11932 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-11932 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11932 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11932 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/1126 · Telegram Post
• https://aliceandbob.company/the-human-factor-in-an-economy-of-scale · Note
• https://t.me/club1337/67 · Telegram Post
• https://t.me/cvenotify/3727 · Telegram Post
• https://t.me/opennews/6841 · Telegram Post
• https://t.me/tmfeed/84842 · Telegram Post
• https://t.me/tmfeed/84299 · Telegram Post