Cloud-init Security Feature Issue Vulnerability

Cloud-init is a virtual machine initialization tool for cloud platforms. A security vulnerability exists in cloud-init version 19.4 and earlier, which stems from a call to the 'random.choice' function by randstr in the cloudinit/util.py file. An attacker could use this vulnerability to guess a...

Moderate Photon OS Security Update - PHSA-2020-0058

Updates of 'cloud-init', 'ansible' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2020-3.0-0058

Updates of 'cloud-init', 'ansible' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2020-0214

Updates of 'linux-aws', 'linux-secure', 'cloud-init', 'linux-esx', 'libvirt', 'linux' packages of Photon OS have been released...

CVE-2020-8631

A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random strings used for generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the...

CVE-2020-8632

A flaw was found in cloud-init, where it uses short passwords when generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the victim user...

CVE-2020-8632

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

DEBIAN-CVE-2020-8631

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function...

CVE-2020-8631

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function...

DEBIAN-CVE-2020-8632

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

CVE-2020-8631

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function...

CVE-2020-8632

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

CVE-2020-8632

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

CVE-2020-8631

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function...

UBUNTU-CVE-2020-8632

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

UBUNTU-CVE-2020-8631

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function...

Design/Logic Flaw

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

Design/Logic Flaw

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function...

CVE-2020-8632

In cloud-init up to 19.4, CVE-2020-8632 affects rand_user_password in cloudinit/config/cc_set_passwords.py, where a small default pwlen makes password guessing easier. This is a local vulnerability (attack vector: LOCAL) with partial confidentiality impact and no integrity/availability impact per...

CVE-2020-8632

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...