PT-2022-27083 · Openstack · Openstack Sushy-Tools

Published 2022-10-29 · Updated 2023-02-09 · CVE-2022-44020

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Sushy-Tools versions 0.21.0 and earlier VirtualBMC versions 2.2.2 and earlier

Description An issue was discovered where changing the boot device configuration with the affected packages removes password protection from the managed libvirt XML domain. This issue only affects an "unsupported, production-like configuration."

Recommendations For OpenStack Sushy-Tools versions 0.21.0 and earlier, consider restricting changes to the boot device configuration until a fix is available. For VirtualBMC versions 2.2.2 and earlier, consider restricting changes to the boot device configuration until a fix is available. As a temporary workaround, consider disabling the ability to change the boot device configuration to minimize the risk of exploitation.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2022-44020

GHSA-5PJ3-6FQM-8M7M

RHSA-2022:8896

Affected Products

Openstack Sushy-Tools

References · 15

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KEQVJF3OQGSDCSQTQQSC54JEGLMSNB4Q · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QMSUGS4B6EBRHBJMTRXL5RIKJTZTEMJC · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEQVJF3OQGSDCSQTQQSC54JEGLMSNB4Q · Vendor Advisory
• https://review.opendev.org/c/openstack/virtualbmc/+/862620 · Vendor Advisory
• https://review.opendev.org/c/openstack/sushy-tools/+/862625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44020 · Security Note
• https://osv.dev/vulnerability/GHSA-5pj3-6fqm-8m7m · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMSUGS4B6EBRHBJMTRXL5RIKJTZTEMJC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-44020 · Vendor Advisory
• https://github.com/umago/virtualbmc · Note
• https://t.me/cibsecurity/52275 · Telegram Post
• https://storyboard.openstack.org/#%21/story/2010382 · Note
• https://storyboard.openstack.org/#!/story/2010382 · Note