PT-2020-20241 · Canonical+4 · Cloud-Init+4

Dimitri John Ledkov + 1 · Published 2020-02-05 · Updated 2024-06-15 · CVE-2020-8631

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions cloud-init versions prior to 19.4

Description The issue is related to the use of Mersenne Twister for generating random passwords, which can make it easier for attackers to predict passwords. This is because the rand str function in cloudinit/util.py calls the random.choice function.

Recommendations For cloud-init versions prior to 19.4, consider updating to a version that uses a more secure random number generator to mitigate the risk of password prediction. As a temporary workaround, consider generating passwords manually using a secure method until a patched version is available.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

ALT-PU-2020-1691

ALT-PU-2020-1866

CESA-2020_3898

CESA-2020_4650

CVE-2020-8631

DLA-2113-1

MGASA-2020-0295

OPENSUSE-SU-2020:0400-1

OPENSUSE-SU-2020_0400-1

OPENSUSE-SU-2024:10688-1

RHSA-2020:3898

RHSA-2020:4650

RHSA-2020_3898

RHSA-2020_4650

SUSE-SU-2020:0585-1

SUSE-SU-2020:0751-1

SUSE-SU-2020:0818-1

SUSE-SU-2020_0585-1

SUSE-SU-2020_0751-1

SUSE-SU-2020_0818-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Cloud-Init

References · 34

• https://github.com/canonical/cloud-init/pull/204 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-8631 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:0818-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-8631 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0751-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-8631 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8631 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0295 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0295.html · Security Note
• https://debian.org/lts/security/2020/dla-2113 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0585-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8631 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00042.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2113-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3898.html · Vendor Advisory