USN-8892-1: Ubuntu Pro for WSL vulnerability
Ubuntu Pro for WSL leaked subscription attach tokens in command-line arguments, risking unauthorized repository access.
Ubuntu Security Notice USN-8892-1 says researcher Darshan U found that Ubuntu Pro for WSL exposed the subscription attach token in command-line arguments when enabling a subscription. An attacker who can read those arguments could obtain the token and potentially access Ubuntu Pro repositories without authorization. The notice cites no CVE and does not report active exploitation.
- Attach token appeared in WSL command-line arguments.
- Exposure could allow unauthorized Ubuntu Pro repository access.
- No CVE identifier or in-the-wild exploitation is stated.
- Vendors
- Canonical
- Products
- Ubuntu Pro for WSL
- Organizations
- Canonical
From the original article
Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in command-line arguments when enabling a subscription on a WSL instance. An attacker could possibly use this issue to obtain sensitive information and gain unauthorized access to Ubuntu Pro repositories.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.