Canonical Subiquity vulnerabilities

3 CVEs affecting Canonical Subiquity, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-0555, published 2024-06-03.

More from Canonical.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-11932, published 2020-05-13. Low severity, CVSS 2.3. EPSS: 0.6% chance of exploitation in the next 30 days. It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
• CVE-2022-0555, published 2024-06-03. High severity, CVSS 8.4. EPSS: 0.3% chance of exploitation in the next 30 days. Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
• CVE-2023-5182, published 2023-10-07. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwords and possibly escalate their…