CVE-2020-8631 describes a vulnerability in cloud-init through version 19.4, where the use of Mersenne Twister for generating random passwords makes them predictable. This affects various distributions including Canonical, Debian, and openSUSE cloud-init packages. With a CVSS score of 5.5 (Medium), this local vulnerability allows an attacker with low privileges to potentially predict passwords, leading to high confidentiality impact. There is no evidence of active exploitation, nor are there known public exploit tools like Metasploit or ExploitDB entries, and it has garnered minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 19.4CPE matchmatch criteria | cpe:2.3:a:canonical:cloud-init:*:*:*:*:*:*:*:* | ||
15.1CPE matchmatch criteria | cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2020-8631
Aug 11, 2020cloud-init through 19.4 relies on Mersenne Twister for a random password which makes it easier for attackers to predict passwords because rand_str in cloudinit/util.py calls the random.choice function.
Feb 11, 2020cloud-init: Use of random.choice when generating random password
Feb 5, 2020