OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

🗓️ 13 Jul 2026 14:19:51Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 3 Views

Changing boot device in OpenStack Sushy-Tools up to 0.21.0 and VirtualBMC up to 2.2.2 removes password protection on the libvirt domain.

Reporter	Title	Published	Views	Family All 29
Circl	CVE-2022-44020	30 Oct 202211:34	–	circl
CNNVD	OpenStack 安全漏洞	30 Oct 202200:00	–	cnnvd
CVE	CVE-2022-44020	29 Oct 202200:00	–	cve
Cvelist	CVE-2022-44020	29 Oct 202200:00	–	cvelist
EUVD	EUVD-2022-7030	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 35 Update: python-virtualbmc-3.0.0-1.fc35	29 Nov 202200:57	–	fedora
Fedora	[SECURITY] Fedora 36 Update: python-virtualbmc-3.0.0-1.fc36	29 Nov 202201:28	–	fedora
Fedora	[SECURITY] Fedora 37 Update: python-virtualbmc-3.0.0-1.fc37	29 Nov 202201:14	–	fedora
Tenable Nessus	Fedora 35 : python-virtualbmc (2022-42723b43fe)	23 Dec 202200:00	–	nessus
Tenable Nessus	Fedora 37 : python-virtualbmc (2022-471e14677d)	14 Nov 202400:00	–	nessus

Vulners

Node

pypi sushy-toolsRange0–0.21.1

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-44020
github	www.github.com/umago/virtualbmc
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/KEQVJF3OQGSDCSQTQQSC54JEGLMSNB4Q
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/QMSUGS4B6EBRHBJMTRXL5RIKJTZTEMJC
review	www.review.opendev.org/c/openstack/sushy-tools/+/862625
review	www.review.opendev.org/c/openstack/virtualbmc/+/862620
storyboard	www.storyboard.openstack.org/
pypi	www.pypi.org/project/sushy-tools
github	www.github.com/advisories/GHSA-5pj3-6fqm-8m7m

13 Jul 2026 16:06Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.5

EPSS0.0022

SSVC