CVE-2020-8631
First published: Wed Feb 05 2020(Updated: )
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Canonical cloud-init | <=19.4 | |
| openSUSE Leap | =15.1 | |
| Debian Debian Linux | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-8631?
CVE-2020-8631 is a vulnerability in cloud-init through version 19.4 that relies on the Mersenne Twister random number generator, making it easier for attackers to predict passwords.
How does CVE-2020-8631 affect cloud-init?
CVE-2020-8631 affects cloud-init versions up to and including 19.4, where the use of the Mersenne Twister random number generator in generating passwords makes it easier for attackers to predict passwords.
Which software versions are affected by CVE-2020-8631?
CVE-2020-8631 affects cloud-init versions up to and including 19.4, as well as openSUSE Leap 15.1 and Debian Linux 8.0.
What is the severity of CVE-2020-8631?
The severity of CVE-2020-8631 is medium, with a severity value of 5.5.
How can I fix CVE-2020-8631?
To fix CVE-2020-8631, it is recommended to update cloud-init to a version that addresses the vulnerability.
- agent/references
- agent/type
- agent/remedy
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- agent/first-publish-date
- agent/source
- vendor/canonical
- canonical/canonical cloud-init
- version/canonical cloud-init/19.4
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.1
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0