Bug 2142678 (CVE-2022-44020) - CVE-2022-44020 Sushy-Tools & VirtualBMC: removes password protection from the managed libvirt XML domain
Summary: CVE-2022-44020 Sushy-Tools & VirtualBMC: removes password protection from the...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-44020
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2142679 2142981 2142721 2142980 2142982
Blocks: 2139047
TreeView+ depends on / blocked
 
Reported: 2022-11-14 21:05 UTC by Anten Skrabec
Modified: 2023-08-08 03:03 UTC (History)
15 users (show)

Fixed In Version: sushy-tools 0.22.0, virtualbmc 2.2.3
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in sushy-tools & VirtualBMC, where changing the boot device configuration removes password protection from the managed libvirt XML domain.
Clone Of:
Environment:
Last Closed: 2022-12-10 10:14:01 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:8896 0 None None None 2022-12-08 10:53:46 UTC

Description Anten Skrabec 2022-11-14 21:05:43 UTC 
An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."
Comment 1 Anten Skrabec 2022-11-14 21:05:58 UTC 
Created python-sushy-tools tracking bugs for this issue:

Affects: openstack-rdo [bug 2142679]
Comment 3 Anten Skrabec 2022-11-15 17:26:06 UTC 
Created python-virtualbmc tracking bugs for this issue:

Affects: fedora-all [bug 2142980]
Affects: openstack-rdo [bug 2142981]
Comment 5 Alfredo Moralejo 2022-11-25 10:32:53 UTC 
There is not sushy-tools 0.22.0, https://opendev.org/openstack/sushy-tools/tags should fixed-in-version be 0.21.1 instead?
Comment 6 errata-xmlrpc 2022-12-08 10:53:44 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 - ELS
  Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

Via RHSA-2022:8896 https://access.redhat.com/errata/RHSA-2022:8896
Comment 7 Product Security DevOps Team 2022-12-10 10:13:59 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-44020
Note You need to log in before you can comment on or make changes to this bug.