by Kastro
Paper/Archive/CVE-2025-15480

CVE-2025-15480

Canonical Ubuntu — Senstive information disclosure was affecting ubuntu-desktop-provision

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 23.5.235 × 204.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.

Affected

ProductAffectedFixed inSource
Ubuntu≤ 24.04.4–CNA
Ubuntu≤ 25.10–CNA
Ubuntu≤ 25.04–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
canonical (CNA)2.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

patchgithub.com/canonical/ubuntu-desktop-provision/pull/1400patchgithub.com/canonical/ubuntu-desktop-provision/pull/1399