In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-3898 advisory.

    - Resolves: bz#1574338       (CVE-2018-10896 cloud-init: SSH host keys are not regenerated for the new instances [rhel-7])
    - Resolves: bz#1812170       (CVE-2020-8632 cloud-init: Too short random password length in cc_set_password in     config/cc_set_passwords.py [rhel-7])
    - Resolves: bz#1812173       (CVE-2020-8631 cloud-init: Use of random.choice when generating random password [rhel-7])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has cloud-init packages installed that are affected by multiple vulnerabilities:

  - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included ssh_deletekeys: 0,     disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances     created by cloning a golden master or template system, sharing ssh host keys, and being able to     impersonate one another or conduct man-in-the-middle attacks. (CVE-2018-10896)

  - A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some     Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.
    (CVE-2019-0816)

  - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for     attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
    (CVE-2020-8631)

  - In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default     pwlen value, which makes it easier for attackers to guess passwords. (CVE-2020-8632)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote host is prior to 0.7.6-43.23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1486 advisory.

    A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random     strings used for generating a random password in new instances. Depending on the instance configuration, a     remote or local attacker may abuse this vulnerability to guess the password of the victim user.
    (CVE-2020-8631)

    A flaw was found in cloud-init, where it uses short passwords when generating a random password in new     instances. Depending on the instance configuration, a remote or local attacker may abuse this     vulnerability to guess the password of the victim user. (CVE-2020-8632)

    A vulnerability was discovered in cloud-init which can improperly disclose randomly generated passwords as     part of the chpasswd module. The fix prevents the generated password from being written to a world-     readable log file on the local disk. (CVE-2021-3429)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has cloud-init packages installed that are affected by multiple vulnerabilities:

  - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included ssh_deletekeys: 0,     disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances     created by cloning a golden master or template system, sharing ssh host keys, and being able to     impersonate one another or conduct man-in-the-middle attacks. (CVE-2018-10896)

  - In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default     pwlen value, which makes it easier for attackers to guess passwords. (CVE-2020-8632)

  - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for     attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
    (CVE-2020-8631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has cloud-init packages installed that are affected by multiple vulnerabilities:

  - In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default     pwlen value, which makes it easier for attackers to guess passwords. (CVE-2020-8632)

  - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for     attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
    (CVE-2020-8631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:4650 advisory.

  - cloud-init: Use of random.choice when generating random password (CVE-2020-8631)

  - cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py     (CVE-2020-8632)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote host is prior to 19.3-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1576 advisory.

    The default cloud-init configuration included ssh_deletekeys: 0, disabling cloud-init's deletion of ssh     host keys. In some environments, this could lead to instances created by cloning a golden master or     template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-     middle attacks. (CVE-2018-10896)

    A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random     strings used for generating a random password in new instances. Depending on the instance configuration, a     remote or local attacker may abuse this vulnerability to guess the password of the victim user.
    (CVE-2020-8631)

    A flaw was found in cloud-init, where it uses short passwords when generating a random password in new     instances. Depending on the instance configuration, a remote or local attacker may abuse this     vulnerability to guess the password of the victim user. (CVE-2020-8632)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4650 advisory.

    - Resolves: bz#1812171       (CVE-2020-8632 cloud-init: Too short random password length in cc_set_password in     config/cc_set_passwords.py [rhel-8])
    - Resolves: bz#1812174       (CVE-2020-8631 cloud-init: Use of random.choice when generating random password [rhel-8])
    - Resolves: bz#1814152       (CVE-2018-10896 cloud-init: default configuration disabled deletion of SSH host keys [rhel-8])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4650 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: Use of random.choice when generating random password (CVE-2020-8631)

    * cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py     (CVE-2020-8632)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In cloud-init through 19.4, rand_user_password in     cloudinit/config/cc_set_passwords.py has a small     default pwlen value, which makes it easier for     attackers to guess passwords.(CVE-2020-8632)

  - cloud-init through 19.4 relies on Mersenne Twister for     a random password, which makes it easier for attackers     to predict passwords, because rand_str in     cloudinit/util.py calls the random.choice     function.(CVE-2020-8631)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - cloud-init: Use of random.choice when generating random     password (CVE-2020-8631)

  - cloud-init: Too short random password length in     cc_set_password in config/cc_set_passwords.py     (CVE-2020-8632)

  - cloud-init: default configuration disabled deletion of     SSH host keys (CVE-2018-10896)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3898 advisory.

  - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included ssh_deletekeys: 0,     disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances     created by cloning a golden master or template system, sharing ssh host keys, and being able to     impersonate one another or conduct man-in-the-middle attacks. (CVE-2018-10896)

  - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for     attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
    (CVE-2020-8631)

  - In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default     pwlen value, which makes it easier for attackers to guess passwords. (CVE-2020-8632)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3898 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    The following packages have been upgraded to a later upstream version: cloud-init (19.4). (BZ#1803094)

    Security Fix(es):

    * cloud-init: Use of random.choice when generating random password (CVE-2020-8631)

    * cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py     (CVE-2020-8632)

    * cloud-init: default configuration disabled deletion of SSH host keys (CVE-2018-10896)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the cloud-init package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Cloud-init is a set of init scripts for cloud     instances. Cloud instances need special scripts to run     during initialization to retrieve and install ssh keys     and to let the user run various scripts.Security     Fix(es):cloud-init through 19.4 relies on Mersenne     Twister for a random password, which makes it easier     for attackers to predict passwords, because rand_str in     cloudinit/util.py calls the random.choice     function.(CVE-2020-8631)A security feature bypass     exists in Azure SSH Keypairs, due to a change in the     provisioning logic for some Linux images that use     cloud-init, aka 'Azure SSH Keypairs Security Feature     Bypass Vulnerability'.(CVE-2019-0816)In cloud-init     through 19.4, rand_user_password in     cloudinit/config/cc_set_passwords.py has a small     default pwlen value, which makes it easier for     attackers to guess passwords.(CVE-2020-8632)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - cloud-init through 19.4 relies on Mersenne Twister for     a random password, which makes it easier for attackers     to predict passwords, because rand_str in     cloudinit/util.py calls the random.choice     function.(CVE-2020-8631)

  - In cloud-init through 19.4, rand_user_password in     cloudinit/config/cc_set_passwords.py has a small     default pwlen value, which makes it easier for     attackers to guess passwords.(CVE-2020-8632)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cloud-init fixes the following security issues :

  - CVE-2020-8631: Replaced the theoretically predictable     deterministic RNG with the system RNG (bsc#1162937).

  - CVE-2020-8632: Increased the default random password     length from 9 to 20 (bsc#1162936).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for cloud-init fixes the following security issues :

CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG (bsc#1162937).

CVE-2020-8632: Increased the default random password length from 9 to 20 (bsc#1162936).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2020-8631

In cloud-init, relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.

CVE-2020-8632

In cloud-init, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.

For Debian 8 'Jessie', these problems have been fixed in version 0.7.6~bzr976-2+deb8u1.

We recommend that you upgrade your cloud-init packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the cloud package has been released.

ID	Name	Product	Family	Severity
195708	RHEL 6 : cloud-init (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
180994	Oracle Linux 7 : cloud-init (ELSA-2020-3898)	Nessus	Oracle Linux Local Security Checks	high
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	critical
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	critical
164556	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.0.5)	Nessus	Misc.	critical
154516	NewStart CGSL CORE 5.05 / MAIN 5.05 : cloud-init Multiple Vulnerabilities (NS-SA-2021-0151)	Nessus	NewStart CGSL Local Security Checks	high
147917	Amazon Linux AMI : cloud-init (ALAS-2021-1486)	Nessus	Amazon Linux Local Security Checks	medium
147387	NewStart CGSL CORE 5.04 / MAIN 5.04 : cloud-init Multiple Vulnerabilities (NS-SA-2021-0016)	Nessus	NewStart CGSL Local Security Checks	high
147272	NewStart CGSL MAIN 6.02 : cloud-init Multiple Vulnerabilities (NS-SA-2021-0062)	Nessus	NewStart CGSL Local Security Checks	medium
145978	CentOS 8 : cloud-init (CESA-2020:4650)	Nessus	CentOS Local Security Checks	medium
144795	Amazon Linux 2 : cloud-init (ALAS-2021-1576)	Nessus	Amazon Linux Local Security Checks	high
142783	Oracle Linux 8 : cloud-init (ELSA-2020-4650)	Nessus	Oracle Linux Local Security Checks	medium
142375	RHEL 8 : cloud-init (RHSA-2020:4650)	Nessus	Red Hat Local Security Checks	medium
142288	EulerOS 2.0 SP2 : cloud-init (EulerOS-SA-2020-2333)	Nessus	Huawei Local Security Checks	medium
141687	Scientific Linux Security Update : cloud-init on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	high
141635	CentOS 7 : cloud-init (RHSA-2020:3898)	Nessus	CentOS Local Security Checks	high
141025	RHEL 7 : cloud-init (RHSA-2020:3898)	Nessus	Red Hat Local Security Checks	high
136222	EulerOS Virtualization for ARM 64 3.0.2.0 : cloud-init (EulerOS-SA-2020-1519)	Nessus	Huawei Local Security Checks	medium
135502	EulerOS 2.0 SP3 : cloud-init (EulerOS-SA-2020-1373)	Nessus	Huawei Local Security Checks	medium
135005	openSUSE Security Update : cloud-init (openSUSE-2020-400)	Nessus	SuSE Local Security Checks	medium
134854	SUSE SLED15 / SLES15 Security Update : cloud-init (SUSE-SU-2020:0751-1)	Nessus	SuSE Local Security Checks	medium
134795	EulerOS 2.0 SP5 : cloud-init (EulerOS-SA-2020-1304)	Nessus	Huawei Local Security Checks	medium
134778	EulerOS 2.0 SP8 : cloud-init (EulerOS-SA-2020-1286)	Nessus	Huawei Local Security Checks	medium
134294	SUSE SLED15 / SLES15 Security Update : cloud-init (SUSE-SU-2020:0585-1)	Nessus	SuSE Local Security Checks	medium
133875	Debian DLA-2113-1 : cloud-init security update	Nessus	Debian Local Security Checks	medium
133805	Photon OS 3.0: Cloud PHSA-2020-3.0-0058	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2020-8632

medium

Tenable Plugins

high

high

critical

critical

critical

high

medium

high

medium

medium

high

medium

medium

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium