In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Canonical
  • Ubuntu
  • Ubuntu Desktop Provision

Configuration 1 [-]

cpe:2.3:a:canonical:ubuntu_desktop_provision:24.04.4:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/canonical/ubuntu-desktop-provision/pull/1399 cve-icon cve-icon
https://github.com/canonical/ubuntu-desktop-provision/pull/1400 cve-icon cve-icon
History

Fri, 17 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

 cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

Fri, 17 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Canonical ubuntu Desktop Provision
CPEs cpe:2.3:a:canonical:ubuntu_desktop_provision:24.04.4:*:*:*:*:*:*:*
Vendors & Products Canonical ubuntu Desktop Provision
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Fri, 10 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Canonical
Canonical ubuntu
Vendors & Products Canonical
Canonical ubuntu

Thu, 09 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
Description In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.
Title Senstive information disclosure was affecting ubuntu-desktop-provision
Weaknesses CWE-1258
References
Metrics cvssV4_0

{'score': 2.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U'}
cve-icon MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2026-04-09T15:02:14.066Z

Updated: 2026-04-10T13:57:17.350Z

Reserved: 2026-01-07T14:28:47.147Z

Link: CVE-2025-15480

cve-icon Vulnrichment

Updated: 2026-04-10T13:56:58.292Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-09T16:16:25.250

Modified: 2026-04-17T20:18:08.243

Link: CVE-2025-15480

cve-icon Redhat

No data.