CVE-2020-8631

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00042.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/1860795Issue Tracking, Patch, Third Party Advisory
https://github.com/canonical/cloud-init/pull/204Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00021.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00042.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/1860795Issue Tracking, Patch, Third Party Advisory
https://github.com/canonical/cloud-init/pull/204Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00021.htmlMailing List, Third Party Advisory

Timeline

Published: Feb 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-86325.5In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easie CVE-2020-86335.3An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the c CVE-2020-86347.8Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, CVE-2020-86357.8Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This all CVE-2020-86369.8An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution .CVE-2020-86379.8A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id CVE-2020-86389.8A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency param CVE-2020-86398.8An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uplo CVE-2020-86418.8Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.CVE-2020-86449.8PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.CVE-2020-86459.8An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job applications search f CVE-2020-86476.1There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.