K33846344 : Cloud-init vulnerabilities CVE-2020-8631 and CVE-2020-8632

Security Advisory Description

• CVE-2020-8631

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.

• CVE-2020-8632

In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.

Impact

There is no impact; F5 products are not affected by this vulnerability.