CVE-2020-8631: Medium severity Canonical cloud-init vulnerability
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-8631?
CVE-2020-8631 is a vulnerability in cloud-init through version 19.4 that relies on the Mersenne Twister random number generator, making it easier for attackers to predict passwords.
How does CVE-2020-8631 affect cloud-init?
CVE-2020-8631 affects cloud-init versions up to and including 19.4, where the use of the Mersenne Twister random number generator in generating passwords makes it easier for attackers to predict passwords.
Which software versions are affected by CVE-2020-8631?
CVE-2020-8631 affects cloud-init versions up to and including 19.4, as well as openSUSE Leap 15.1 and Debian Linux 8.0.
What is the severity of CVE-2020-8631?
The severity of CVE-2020-8631 is medium, with a severity value of 5.5.
How can I fix CVE-2020-8631?
To fix CVE-2020-8631, it is recommended to update cloud-init to a version that addresses the vulnerability.