低危 config / cc_set_passwords.py中cc_set_password中的随机密码长度太短
CVE编号
CVE-2020-8632利用情况
暂无补丁情况
官方补丁披露时间
2020-02-06漏洞描述
在从19.4开始的cloud-init中，cloudinit / config / cc_set_passwords.py中的rand_user_password具有较小的默认pwlen值，这使攻击者更容易猜测密码。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | canonical | cloud-init | * | Up to (including) 19.4 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alibaba_cloud_linux_2.1903 | cloud-init | * | Up to (excluding) 19.1.17-1.0.1.al7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | cloud-init | * | Up to (excluding) 19.3-4.amzn2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | cloud-init | * | Up to (excluding) 0.7.6-43.23.amzn1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | centos_7 | cloud-init | * | Up to (excluding) 19.4-7.el7.centos | |||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | cloud-init | * | Up to (excluding) 19.4-11.el8 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | cloud-init | * | Up to (excluding) 19.4-2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_11 | cloud-init | * | Up to (excluding) 19.4-2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_12 | cloud-init | * | Up to (excluding) 19.4-2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_sid | cloud-init | * | Up to (excluding) 19.4-2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.1 | cloud-init-config-suse | * | Up to (excluding) 19.4-lp151.2.15.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | oraclelinux-release | * | Up to (excluding) 19.4-7.0.3.el7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_8 | oraclelinux-release | * | Up to (excluding) 19.4-11.0.1.el8 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | cloud-init | * | Up to (excluding) 19.4-7.el7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | cloud-init | * | Up to (excluding) 19.4-11.el8 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12 | cloud-init | * | Up to (excluding) 19.4-37.39 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | cloud-init | * | Up to (excluding) 20.2-45-g5f7825e2-0ubuntu1~18.04.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_20.04 | cloud-init | * | Up to (excluding) 20.1-10-g71af48df-0ubuntu5 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_21.04 | cloud-init | * | Up to (excluding) 21.1-19-gbad84ad4-0ubuntu2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_21.10 | cloud-init | * | Up to (excluding) 21.3-1-g6803368d-0ubuntu3 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_22.04 | cloud-init | * | Up to (excluding) 21.4-25-g039c40f9-0ubuntu1~22.04.1 | |||||
- 攻击路径 本地
- 攻击复杂度 复杂
- 权限要求 普通权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
| CWE-ID | 漏洞类型 |
| CWE-521 | 弱口令要求 |
| CWE-522 | 不充分的凭证保护机制 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论