Read the docs
TI-2022-21646 Aliases CVE-2022-44020GHSA-5pj3-6fqm-8m7m

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through…

Priority LOW 24CWE-281Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00241 15th percentileScored 2026-11-07
Fix Fixed sushy-tools (PyPI): 0.21.1virtualbmc (PyPI): 3.0.0Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—sushy-tools (PyPI)before 0.21.10.21.1Patch availableGHSA-5pj3-6fqm-8m7m
—virtualbmc (PyPI)before 3.0.03.0.0Patch availableGHSA-5pj3-6fqm-8m7m
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • sushy-tools (PyPI) Vendor— Affected before 0.21.1 Fixed in 0.21.1 Patch available GHSA-5pj3-6fqm-8m7m
  • virtualbmc (PyPI) Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available GHSA-5pj3-6fqm-8m7m

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:opendev:sushy-tools:*:*:*:*:*:openstack:*:*before 0.21.1VulnerableOpendev
cpe:2.3:a:opendev:virtualbmc:*:*:*:*:*:openstack:*:*before 3.0.0VulnerableOpendev
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:opendev:sushy-tools:*:*:*:*:*:openstack:*:* Versions before 0.21.1 Vulnerable ·Opendev
  • cpe:2.3:a:opendev:virtualbmc:*:*:*:*:*:openstack:*:* Versions before 3.0.0 Vulnerable ·Opendev
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-5pj3-6fqm-8m7m sushy-tools (PyPI) Fixed in 0.21.1 Advisory →
  • Fix · GHSA-5pj3-6fqm-8m7m virtualbmc (PyPI) Fixed in 3.0.0 Advisory →

Red Hat 1 advisory

  • RHSA-2022:8896 Released 2022-12-08 · Red Hat rating Moderate
    Red Hat OpenStack Platform 13.0 (python-virtualbmc) security update
    • Red Hat OpenStack Platform 13.0 - ELS python-virtualbmc-1.2.0-2.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-virtualbmc-1.2.0-2.el7ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2022:8896
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2022:8896
Not affected: 3 products
  • Red Hat Enterprise Linux 8
  • Red Hat OpenStack Platform 13.0 - ELS
  • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-44020
  2. 2026-10-03 Alias added: GHSA-5pj3-6fqm-8m7m

References

Patch 2

Advisory 4

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences