Red Hat Security AdvisoryRHSA-2020:4650
cloud-init security, bug fix, and enhancement update
Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) cloud-init-19.4-11.el8
Fixes 2 records
Priority LOW 25
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.0038 · Published 2020-02-05 · Partial fix CWE-521
Priority LOW 25
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00435 · Published 2020-02-05 · Partial fix CWE-330
