CVE-2022-44020
Medium
Description
An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."
SeverityMedium
CVSS5.5
Exploit probability15. percentile0.2%
Product
Opendev Sushy-tools
PublishedOct 30, 2022
First seenOct 30, 2022
Weakness typeCWE-281CWE-281
How to fix
Update
- opendev sushy-tools0.21.1 or later
- opendev virtualbmc3.0.0 or later
- sushy-tools0.21.1 or later
- virtualbmc3.0.0 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEQVJF3OQGSDCSQTQQSC54JEGLMSNB4Q/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMSUGS4B6EBRHBJMTRXL5RIKJTZTEMJC/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opendev sushy-tools | v < 0.21.1 | 0.21.1 |
| opendev virtualbmc | v < 3.0.0 | 3.0.0 |
| fedoraproject fedora | 35, 36, 37 | — |
| sushy-toolsPyPI | v < 0.21.1 | 0.21.1 |
| virtualbmcPyPI | v < 3.0.0 | 3.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.