SUSE CVE-2020-8631

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function...

Prime95 30.7 Build 9 Buffer Overflow Exploit

Exploit Title: Prime95 Version 30.7 build 9 Buffer Overflow RCE Discovered by: Yehia Elghaly Vendor Homepage: https://www.mersenne.org/ Software Link : https://www.mersenne.org/ftproot/gimps/p95v307b9.win32.zip Tested Version: 30.7 build 9 Vulnerability Type: Buffer Overflow RCE Local Tested on O...

PT-2022-7862 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo affected versions not specified Description: The issue affects Piwigo, an image gallery software written in PHP. When certain criteria are not met on a host, Piwigo defaults to using mt rand to generate password reset tokens. The outpu...

Mageia: Security Advisory (MGASA-2020-0295)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NewStart CGSL CORE 5.05 / MAIN 5.05 : cloud-init Multiple Vulnerabilities (NS-SA-2021-0151)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has cloud-init packages installed that are affected by multiple vulnerabilities: - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys...

Amazon Linux AMI : cloud-init (ALAS-2021-1486)

The version of cloud-init installed on the remote host is prior to 0.7.6-43.23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1486 advisory. A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random strings used...

NewStart CGSL MAIN 6.02 : cloud-init Multiple Vulnerabilities (NS-SA-2021-0062)

The remote NewStart CGSL host, running version MAIN 6.02, has cloud-init packages installed that are affected by multiple vulnerabilities: - In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to...

NewStart CGSL CORE 5.04 / MAIN 5.04 : cloud-init Multiple Vulnerabilities (NS-SA-2021-0016)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has cloud-init packages installed that are affected by multiple vulnerabilities: - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys...

Amazon Linux 2 : cloud-init (ALAS-2021-1576)

The version of cloud-init installed on the remote host is prior to 19.3-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1576 advisory. The default cloud-init configuration included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys. In som...

Oracle Linux 8 : cloud-init (ELSA-2020-4650)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4650 advisory. - Resolves: bz1812171 CVE-2020-8632 cloud-init: Too short random password length in ccsetpassword in config/ccsetpasswords.py rhel-8 - Resolves:...

EulerOS 2.0 SP2 : cloud-init (EulerOS-SA-2020-2333)

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for...

cloud-init through 19.4 relies on Mersenne Twister for a random password which makes it easier for attackers to predict passwords because rand_str in cloudinit/util.py calls the random.choice function.

...

MGASA-2020-0295 Updated cloud-init packages fix security vulnerability

In cloud-init, relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function CVE-2020-8631. In cloud-init, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default...

Updated cloud-init packages fix security vulnerability

In cloud-init, relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function CVE-2020-8631. In cloud-init, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default...

Lazarus on the hunt for big game

We may only be six months in, but theres little doubt that 2020 will go down in history as a rather unpleasant year. In the field of cybersecurity, the collective hurt mostly crystallized around the increasing prevalence of targeted ransomware attacks. By investigating a number of these incidents...

EulerOS Virtualization 3.0.6.0 : cloud-init (EulerOS-SA-2020-1751)

According to the versions of the cloud-init package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that u...

EulerOS Virtualization for ARM 64 3.0.2.0 : cloud-init (EulerOS-SA-2020-1519)

According to the versions of the cloud-init package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Cloud-init is a set of init scripts for cloud instances. Cloud instances need special scripts to run during...

EulerOS 2.0 SP3 : cloud-init (EulerOS-SA-2020-1373)

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because...

EulerOS Virtualization for ARM 64 3.0.6.0 : cloud-init (EulerOS-SA-2020-1356)

According to the version of the cloud-init package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predi...

Huawei EulerOS: Security Advisory for cloud-init (EulerOS-SA-2020-1356)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...