EUVD-2025-209377Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware debug access restrictions
|
| Impact | The CVSS 2.7 base score (CVSS:4.0/AV:N/AC:L/PR:N/UI:N) reflects a network-accessible vulnerability with low attack complexity, but the overall severity is tempered by multiple real-world constraints. The UI:N field indicates no user interaction in the vector definition; however, the actual attack requires user choice to submit a bug report-a practical UI/UX barrier that elevates real-world friction. The VC:L (Confidentiality impact: Low) underestimates the actual severity: password hashes are high-value targets for offline brute-force and dictionary attacks, enabling account compromise. The CVSS vector's unusually low VC rating conflicts with the vulnerability's true impact (sensitive credential exposure). EPSS and KEV status unknown; no confirmation of active exploitation. The vulnerability is low-friction for attackers *if* users trigger reporting, but depends on user actions and Ubuntu version targeting specific LTS/current releases. Patch availability significantly reduces real-world risk for organizations that apply updates. Assess as medium priority for patch deployment due to credential exposure severity, despite low CVSS, particularly for enterprises managing shared Ubuntu deployments or providing technical support (where users are more likely to file bug reports). |
| Exploit ScenarioDerived | A user installing Ubuntu 24.04.4 on a new machine encounters an installation failure mid-process. The system prompts the user to report the issue to Launchpad to help improve Ubuntu. The user, attempting to be helpful, clicks submit; ubuntu-desktop-provision attaches diagnostic logs including the user's password hash from the failed provisioning attempt. An attacker monitoring public Launchpad bug reports for ubuntu-desktop-provision extracts the submitted logs, obtains the password hash, and uses offline brute-force tools to crack the hash, gaining credentials for the Ubuntu system. No exploit code is required; exploitation is purely social-engineering and log scraping. The low CVSS does not reflect the actual impact of credential compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
ubuntu-desktop-provision version 24.04.4 leaks user password hashes in crash report logs submitted to Launchpad during installation failures. An unauthenticated remote attacker can obtain sensitive credentials if a user opts to report the installation failure, requiring user interaction to trigger the vulnerability but resulting in direct exposure of authentication material. Patch available from Canonical via GitHub pull requests; EPSS and KEV status not actively exploited at time of analysis.
RemediationAI
Vendor-released patch available via GitHub pull requests #1400 and #1399 to canonical/ubuntu-desktop-provision; apply these patches immediately to affected systems. Users should upgrade ubuntu-desktop-provision to a patched version released after these PRs are merged and shipped in Ubuntu security updates. Check Canonical's security advisories (https://usn.ubuntu.com) for the specific patched package version number and apply via apt update && apt upgrade ubuntu-desktop-provision or full system updates. Workaround pending patch deployment: users experiencing installation failures should avoid submitting bug reports to Launchpad, or manually review and redact sensitive information from crash logs before submission. System administrators should monitor Launchpad bug reports submitted from affected Ubuntu versions and request users to re-file without sensitive credential data if encountered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ubuntu-desktop-provision is a desktop environment provisioning tool in Ubuntu responsible for system installation and configuration. The vulnerability stems from inadequate sanitization of diagnostic logs before transmission to Launchpad's bug reporting system (CWE-1258: Insertion of Sensitive Information into Log File). During installation failure scenarios, the application includes unfiltered user credentials-specifically password hashes-in crash report attachments. This occurs at the intersection of error handling, logging infrastructure, and third-party service integration, where sensitive material from configuration or credential stores is written to log files without redaction or filtering before external submission.
Know when Canonical gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U
Primary rating from Vendor (canonical) · only source for this CVE.
CVSS VectorVendor: canonical
Lifecycle Timeline
2DescriptionCVE.org
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Exploit-DB