CVE-2020-8632

CWE-521CWE-522 — Insufficiently Protected CredentialsCWE-33010 documents8 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 73.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Canonical Cloud-initDebian Debian LinuxOpensuse Leap
Timeline
PublishedFeb 5
Latest updateMay 24

Description

In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶Debiancloud-init< 19.4-2+3
▶NVDopensuse/leap15.1

Also affects: Debian Linux 8.0

Patches

Patch: bugs.launchpad.net ↗Patch: github.com ↗Patch: bugs.launchpad.net ↗

🔴Vulnerability Details

3
GHSA
GHSA-xcwr-9f5c-qg65: In cloud-init through 19↗2022-05-24
▶
OSV
CVE-2020-8632: In cloud-init through 19↗2020-02-05
▶
CVEList
CVE-2020-8632: In cloud-init through 19↗2020-02-05
▶

📋Vendor Advisories

3
Microsoft
In cloud-init through 19.4 rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value which makes it easier for attackers to guess passwords.↗2020-02-11
▶
Red Hat
cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py↗2020-02-05
▶
Debian
CVE-2020-8632: cloud-init - In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwo...↗2020
▶

💬Community

3
Bugzilla
CVE-2020-8632 cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py↗2020-02-05
▶
Bugzilla
CVE-2020-8632 cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py [epel-6]↗2020-02-05
▶
Bugzilla
CVE-2020-8632 cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py [fedora-all]↗2020-02-05
▶
CVE-2020-8632 (MEDIUM CVSS 5.5) | In cloud-init through 19.4 | cvebase.io