Ubuntu.comUB:CVE-2020-8632CVE-2020-8632
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
13.1%
In cloud-init through 19.4, rand_user_password in
cloudinit/config/cc_set_passwords.py has a small default pwlen value, which
makes it easier for attackers to guess passwords.
Bugs
Notes
| Author | Note |
|---|---|
| ccdm94 | This CVE has been patched in Xenial ESM. The patch, however, has been added only to the updates pocket, and since cloud-init is only used during first boot (pulling from updates), there should not be a need to add this to the security pocket. |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | cloud-init | < 20.2-45-g5f7825e2-0ubuntu1~18.04.1 | UNKNOWN |
| ubuntu | 20.04 | noarch | cloud-init | < 20.1-10-g71af48df-0ubuntu5 | UNKNOWN |
| ubuntu | 20.10 | noarch | cloud-init | < 19.4-56-g06e324ff-0ubuntu1 | UNKNOWN |
| ubuntu | 21.04 | noarch | cloud-init | < 21.1-19-gbad84ad4-0ubuntu2 | UNKNOWN |
| ubuntu | 21.10 | noarch | cloud-init | < 21.3-1-g6803368d-0ubuntu3 | UNKNOWN |
| ubuntu | 22.04 | noarch | cloud-init | < 21.4-25-g039c40f9-0ubuntu1~22.04.1 | UNKNOWN |
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
13.1%