GitHub Advisory DatabaseGHSA-5PJ3-6FQM-8M7MOpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
17.8%
An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an “unsupported, production-like configuration.”
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| * | virtualbmc | * | cpe:2.3:a:*:virtualbmc:*:*:*:*:*:*:*:* |
| sushy | tools | * | cpe:2.3:a:sushy:tools:*:*:*:*:*:*:*:* |
References
github.com/advisories/GHSA-5pj3-6fqm-8m7m
lists.fedoraproject.org/archives/list/[email protected]/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE
lists.fedoraproject.org/archives/list/[email protected]/message/KEQVJF3OQGSDCSQTQQSC54JEGLMSNB4Q
lists.fedoraproject.org/archives/list/[email protected]/message/QMSUGS4B6EBRHBJMTRXL5RIKJTZTEMJC
nvd.nist.gov/vuln/detail/CVE-2022-44020
review.opendev.org/c/openstack/sushy-tools/+/862625
review.opendev.org/c/openstack/virtualbmc/+/862620
storyboard.openstack.org/#!/story/2010382
Related
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
17.8%