Debian alert DLA-4645-1 (cloud-init)

From:
             
 
Noah Meyerhans <noahm@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4645-1] cloud-init - correct sources.list generation
Date:
             
 
Wed, 24 Jun 2026 10:12:47 -0400
Message-ID:
             
 
<ajvl3wWf0AN6Knb3@doom.morgul.net>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4645-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Noah Meyerhans
June 24, 2026                                 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : cloud-init
Version        : 20.4.1-2+deb11u2
Debian Bug     : 1110240

Cloud-init, an initialization system for provisioning cloud instances
and other virtual machines, has the ability to generate apt sources
when provisioning a system.  The version currently in bullseye
generates incorrect sources.list entries for the security repository,
resulting in VMs that do not download security updates as expected,
and also references the defunct bullseye-backports repository.

For Debian 11 bullseye, this problem has been fixed in version
20.4.1-2+deb11u2.

We recommend that you upgrade your cloud-init packages.

For the detailed security status of cloud-init please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cloud-init

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE5G+E0xEKhJuZ7RJ34+c1IpshdTUFAmo75SkACgkQ4+c1Ipsh
dTWYjQ/+L3OKwjIFnu5qKQTrbQFX533XdvCSNvSftgqoQvG8YfD5S3Mhftz34rNu
SpftDipymOO+9MtdPl5M+Y8Z2yWDxwx64XUVx3F2svZRYJ8Po1dT1K47SXR/OS7s
//Cxs6XxWbQArwOB+f7n07lFZl/99Mle+LyEF4vuFt3ROk93wO0LrlXsxdcdNuq+
RFxP8wYrnBnBjI6szOQFxQL2Fsu17UyjstLp9ubKE6xJOnAtq0eX1zcRmkJAFcWZ
1SDp0LMDmEGaK/6lrsF9R+7b9HiADA7pZ0jMGiHZCMFhOboTcB9PUFaqT2oVKL/4
k5IMisuB5iMCEHxpEDBVQ/Pgb7U0RLz5aJPywi1Jp9kQR+BjqcAXAwPoocOQJYAU
qG8GEWhnVq/cE+4cfA6QEgn2mbXBmlRZzrBWNllT6VKcD2AmGQWkEfcrW9rRgN66
UDxAPK2dSW5A3Bh9+A7flEau58tSZMMFZqvH+/f/7hLM1mctYFn9h3MhKVjYJrXZ
+FaSP5ZZwecmiXGdlaD8ubyJG6qFbdr406GHmTz9W7mphqO3gZ4WTGB58//MLQAF
EDdDz+Of/RuErzytyNoPkzRNpFpjhSJps5ZIPS9G0AmcyBbTOC71cj95r1M/UO7l
FRIUY48yr5L1NxaukkS52BvPC2d+rxFMTcIV8hswVw522D/A/NE=
=xb5K
-----END PGP SIGNATURE-----