CLSA-2026-1791533950

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791533950.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1791533950
Upstream
CVE (4)
Published
2026-10-09T08:19:17Z
Modified
2026-10-26T09:43:36Z
Summary
cloud-init: Fix of 4 CVEs
Details
  • CVE-2024-6174: fix platform enumeration by changing default policy of ds-identify to disallow discovery of datasources without strict identifiable
  • CVE-2024-11584: fix systemd socket unit permission vulnerability to prevent unprivileged user from triggering hotplug-hook commands
  • CVE-2023-1786: fix leak of sensitive user/vendor data and enforce 640 perms on cloud-init.log
  • CVE-2022-2084: remove schema errors from log to avoid leaking sensitive user-data values into world-readable /var/log/cloud-init.log
  • rebuild with the vendor .el9_2 dist so the update outranks AlmaLinux 22.1-10.el9_2.alma
References

Affected packages

TuxCare:AlmaLinux:9.2 / cloud-init

Package

Name
cloud-init
Purl
pkg:rpm/tuxcare/cloud-init?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
22.1-10.el9_2.alma.tuxcare.els5

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791533950.json"