Every CVE Search/ Get API key

CVE-2022-44020

OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

5.5 MediumFix available

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.24%Down 0.6 points since Oct 30, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Record
CVE-2022-44020
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-281
Updated
2026-11-02
CVE List 5.5

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Record
CVE-2022-44020
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-281
Updated
2026-11-02
EUVDEUVD-2022-7030 5.5

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Record
EUVD-2022-7030
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5pj3-6fqm-8m7m 5.5

OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Record
GHSA-5pj3-6fqm-8m7m
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-281
Updated
2026-11-02
OSV 5.5

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Record
CVE-2022-44020
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-5pj3-6fqm-8m7m 5.5

OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Record
GHSA-5pj3-6fqm-8m7m
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-281
Updated
2026-11-02
OSVPYSEC-2026-1059 5.5

OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Record
PYSEC-2026-1059
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVPYSEC-2026-3079 5.5

OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Record
PYSEC-2026-3079
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2022:8896 5.5

Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 (python-virtualbmc) security update

Record
RHSA-2022:8896
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sushy-tools
PyPI
 before 0.21.1
0.21.1
virtualbmc
PyPI
 before 3.0.0
3.0.0
sushy-tools
PyPI
 before 0.21.1, plus listed versions
0.0.00.1.00.10.00.11.00.11.1
Show 21 moreShow less
0.12.00.12.10.13.00.14.00.15.00.16.00.17.00.18.00.18.10.18.20.19.00.2.00.20.00.21.00.3.00.4.00.5.00.6.00.7.00.8.00.9.0
0.21.1
virtualbmc
PyPI
 before 3.0.0, plus listed versions
0.0.10.0.20.0.30.0.40.1.0
Show 12 moreShow less
1.0.01.1.01.2.01.3.01.4.01.5.01.6.02.0.02.1.02.2.02.2.12.2.2
3.0.0
python-virtualbmc
Red Hat:openstack:13::el7
 before 0:1.2.0-2.el7ost
0:1.2.0-2.el7ost

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-44020 is a medium vulnerability (CVSS 5.5) in Opendev Sushy-tools, published October 29, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in sushy-tools 0.21.1.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open