This vulnerability affects the Subiquity installer in Ubuntu 24.04.4. When an installation fails and a user submits a bug report to Launchpad, the attached logs may inadvertently contain sensitive information such as plaintext Wi-Fi passwords. This occurs because debug information is not properly cleared before being included in the crash report. The issue is categorized as CWE-1258, exposure of sensitive system information. The CVSS 4.0 score of 2.7 indicates low severity, with network attack vector and low impact on confidentiality. No official remediation or patch details are currently provided.

The impact is the potential exposure of sensitive user credentials, specifically plaintext Wi-Fi passwords, through crash report logs sent to Launchpad after installation failures. This could lead to unauthorized access to user networks if the reports are accessed by malicious actors. However, the overall severity is low due to the requirement of installation failure and user submission of bug reports, and no privileges or user interaction are required beyond that. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid submitting crash reports that may contain sensitive information or review logs before submission if possible. Monitor official Canonical advisories for updates and apply patches promptly once available.