CVE-2020-8631 — Use of Insufficiently Random Values in Cloud-init

CWE-330 — Use of Insufficiently Random Values10 documents8 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 70.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Canonical Cloud-initDebian LinuxOpensuse Leap
Timeline
PublishedFeb 5
Latest updateMay 24

Description

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶Debiancanonical/cloud-init< 19.4-2+3
▶NVDopensuse/leap15.1

Also affects: Debian Linux 8.0

Patches

Patch: bugs.launchpad.net ↗Patch: github.com ↗Patch: bugs.launchpad.net ↗

🔴Vulnerability Details

3
GHSA
GHSA-2r47-hhff-7qcp: cloud-init through 19↗2022-05-24
▶
CVEList
CVE-2020-8631: cloud-init through 19↗2020-02-05
▶
OSV
CVE-2020-8631: cloud-init through 19↗2020-02-05
▶

📋Vendor Advisories

3
Microsoft
cloud-init through 19.4 relies on Mersenne Twister for a random password which makes it easier for attackers to predict passwords because rand_str in cloudinit/util.py calls the random.choice function↗2020-02-11
▶
Red Hat
cloud-init: Use of random.choice when generating random password↗2020-02-05
▶
Debian
CVE-2020-8631: cloud-init - cloud-init through 19.4 relies on Mersenne Twister for a random password, which ...↗2020
▶

💬Community

3
Bugzilla
CVE-2020-8631 cloud-init: Use of random.choice when generating random password [fedora-all]↗2020-02-05
▶
Bugzilla
CVE-2020-8631 cloud-init: Use of random.choice when generating random password [epel-6]↗2020-02-05
▶
Bugzilla
CVE-2020-8631 cloud-init: Use of random.choice when generating random password↗2020-02-05
▶
CVE-2020-8631 — Use of Insufficiently Random Values | cvebase