Stay Secure with the Latest Linux Advisories

security advisorymoderatesecurity issue

Mageia: 2020-0295 Moderate: Cloud-Init Password Prediction Problems

In cloud-init, relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function (CVE-2020-8631). In cloud-init, rand_user_password in cloudinit/config/cc_set_passwords.py . MGASA-2020-0295 - Updated cloud-init packages fix security vulnerability Publication date: 31 Jul 2020 URL: https://advisories.mageia.org/MGASA-2020-0295.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-8631, CVE-2020-8632 In cloud-init, relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function (CVE-2020-8631). In cloud-init, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords (CVE-2020-8632). References: - https://bugs.mageia.org/show_bug.cgi?id=26236 - https://lists.debian.org/debian-lts-announce/2020/02/msg00021.html - https://www.cve.org/CVERecord?id=CVE-2020-8631 - https://www.cve.org/CVERecord?id=CVE-2020-8632 SRPMS: - 7/core/cloud-init-0.7.5-7.1.mga7 . Revised Docker compositional files address vulnerabilities related to exposure of sensitive data. Made available on August 15, 2021.. cloud-init security,mageia update,password vulnerability,security advisory. . LinuxSecurity.com Team

Jul 31, 2020 Mageia