An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0003.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Fedoraproject
  • Fedora
Opendev
  • Sushy-tools
  • Virtualbmc
Redhat
  • Openstack

Configuration 1 [-]

OR cpe:2.3:a:opendev:sushy-tools:*:*:*:*:*:openstack:*:*
cpe:2.3:a:opendev:virtualbmc:*:*:*:*:*:openstack:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat OpenStack Platform 13.0 - ELS
python-virtualbmc-0:1.2.0-2.el7ost cpe:/a:redhat:openstack:13::el7 RHSA-2022:8896 2022-12-08T00:00:00Z
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS
python-virtualbmc-0:1.2.0-2.el7ost cpe:/a:redhat:openstack:13::el7 RHSA-2022:8896 2022-12-08T00:00:00Z

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2022-7030 An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."
Github GHSA Github GHSA GHSA-5pj3-6fqm-8m7m OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEQVJF3OQGSDCSQTQQSC54JEGLMSNB4Q/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMSUGS4B6EBRHBJMTRXL5RIKJTZTEMJC/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-44020 cve-icon
https://review.opendev.org/c/openstack/sushy-tools/+/862625 cve-icon cve-icon cve-icon
https://review.opendev.org/c/openstack/virtualbmc/+/862620 cve-icon cve-icon cve-icon
https://storyboard.openstack.org/#!/story/2010382 cve-icon
https://storyboard.openstack.org/#%21/story/2010382 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-44020 cve-icon
History

Wed, 07 May 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-05-07T13:57:26.002Z

Reserved: 2022-10-29T00:00:00.000Z

Link: CVE-2022-44020

cve-icon Vulnrichment

Updated: 2024-08-03T13:47:05.330Z

cve-icon NVD

Status : Modified

Published: 2022-10-30T00:15:10.130

Modified: 2025-05-07T14:15:38.820

Link: CVE-2022-44020

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-10-26T00:00:00Z

Links: CVE-2022-44020 - Bugzilla

cve-icon OpenCVE Enrichment

No data.