Red Hat Security Advisory: cloud-init security, bug fix, and enhancement update
An update for cloud-init is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-8632US | medium5.5OT elevated | — | ||
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords. | ||||
| CVE-2020-8631US | medium5.5OT elevated | — | ||
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/external
- https://access.redhat.com/errata/RHSA-2020:4650self
- https://access.redhat.com/security/updates/classification/#moderateexternal
- 1760394external
- 1761598external
- 1794664external
- 1798728external
- 1798731external
remediations (4)
- Fixedcloud-init-0:19.4-11.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4650 - Fixedcloud-init-0:19.4-11.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4650 - Fixedcloud-init-0:19.4-11.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4650 - Fixedcloud-init-0:19.4-11.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:4650
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan