CVE-2020-8631
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier...
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
- Record
CVE-2020-8631- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
CVE List No score
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
- Record
CVE-2020-8631- Updated
- 2026-11-02
EUVDEUVD-2020-29479 No score
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
- Record
EUVD-2020-29479- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2r47-hhff-7qcp No score
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier...
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
- Record
GHSA-2r47-hhff-7qcp- Weakness
- CWE-330
- Updated
- 2026-11-02
OSV
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
- Record
CVE-2020-8631- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-8631
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
- Record
DEBIAN-CVE-2020-8631- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 9 moreShow less
OSVRHSA-2020:3898
Red Hat Security Advisory: cloud-init security, bug fix, and enhancement update
- Record
RHSA-2020:3898- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:4650
Red Hat Security Advisory: cloud-init security, bug fix, and enhancement update
- Record
RHSA-2020:4650- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-8631
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
- Record
UBUNTU-CVE-2020-8631- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2020-0295 No score
Updated cloud-init packages fix security vulnerability
In cloud-init, relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function (CVE-2020-8631).
In cloud-init, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords (CVE-2020-8632).
- Record
MGASA-2020-0295- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0400-1 No score
Security update for cloud-init
This update for cloud-init fixes the following security issues:
- CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG (bsc#1162937).
- CVE-2020-8632: Increased the default random password length from 9 to 20 (bsc#1162936).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:0400-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10688-1 No score
cloud-init-21.2-1.2 on GA media
These are all security issues fixed in the cloud-init-21.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10688-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0585-1 No score
Security update for cloud-init
This update for cloud-init fixes the following security issues:
- CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG (bsc#1162937).
- CVE-2020-8632: Increased the default random password length from 9 to 20 (bsc#1162936).
- Record
SUSE-SU-2020:0585-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0751-1 No score
Security update for cloud-init
This update for cloud-init fixes the following security issues:
- CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG (bsc#1162937).
- CVE-2020-8632: Increased the default random password length from 9 to 20 (bsc#1162936).
- Record
SUSE-SU-2020:0751-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0818-1 No score
Security update for cloud-init
This update for cloud-init fixes the following security issues:
- CVE-2020-8631: Replaced the theoretically predictable deterministic random number generator with the system RNG (bsc#1162937).
- CVE-2020-8632: Increased the default random password length from 9 to 20 (bsc#1162936).
- Record
SUSE-SU-2020:0818-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cloud-initDebian:12 |
before 19.4-2 | 19.4-2 |
cloud-initDebian:13 |
before 19.4-2 | 19.4-2 |
cloud-initDebian:14 |
before 19.4-2 | 19.4-2 |
cloud-initDebian:8 |
before 0.7.6~bzr976-2+deb8u1, plus listed versions 0.7.6~bzr976-2 |
0.7.6~bzr976-2+deb8u1 |
cloud-initMageia:7 |
before 0.7.5-7.1.mga7 | 0.7.5-7.1.mga7 |
cloud-initRed Hat:enterprise_linux:7::server |
before 0:19.4-7.el7 | 0:19.4-7.el7 |
cloud-initRed Hat:enterprise_linux:8::appstream |
before 0:19.4-11.el8 | 0:19.4-11.el8 |
cloud-initSUSE:Linux Enterprise Module for Public Cloud 15 |
before 19.4-5.24.1 | 19.4-5.24.1 |
cloud-initSUSE:Linux Enterprise Module for Public Cloud 15 SP1 |
before 19.4-8.17.1 | 19.4-8.17.1 |
cloud-initSUSE:Linux Enterprise Module for Public Cloud 12 |
before 19.4-37.39.1 | 19.4-37.39.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cloud-initUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.7.7~bzr1149-0ubuntu10.7.7~bzr1154-0ubuntu10.7.7~bzr1155-0ubuntu10.7.7~bzr1156-0ubuntu10.7.7~bzr1156-0ubuntu2 Show 45 moreShow less0.7.7~bzr1160-0ubuntu10.7.7~bzr1176-0ubuntu10.7.7~bzr1182-0ubuntu10.7.7~bzr1189-0ubuntu10.7.7~bzr1192-0ubuntu10.7.7~bzr1192-0ubuntu20.7.7~bzr1200-0ubuntu10.7.7~bzr1208-0ubuntu10.7.7~bzr1209-0ubuntu10.7.7~bzr1212-0ubuntu10.7.7~bzr1246-0ubuntu1~16.04.10.7.7~bzr1256-0ubuntu1~16.04.10.7.8-1-g3705bb5-0ubuntu1~16.04.10.7.8-1-g3705bb5-0ubuntu1~16.04.30.7.8-49-g9e904bb-0ubuntu1~16.04.10.7.8-49-g9e904bb-0ubuntu1~16.04.20.7.8-49-g9e904bb-0ubuntu1~16.04.30.7.8-49-g9e904bb-0ubuntu1~16.04.40.7.9-0ubuntu1~16.04.20.7.9-48-g1c795b9-0ubuntu1~16.04.10.7.9-90-g61eb03fe-0ubuntu1~16.04.10.7.9-113-g513e99e0-0ubuntu1~16.04.10.7.9-153-g16a7302f-0ubuntu1~16.04.10.7.9-153-g16a7302f-0ubuntu1~16.04.20.7.9-233-ge586fe35-0ubuntu1~16.04.10.7.9-233-ge586fe35-0ubuntu1~16.04.217.1-27-geb292c18-0ubuntu1~16.04.117.1-46-g7acc9e68-0ubuntu1~16.04.117.2-35-gf576b2a2-0ubuntu1~16.04.218.2-4-g05926e48-0ubuntu1~16.04.118.2-4-g05926e48-0ubuntu1~16.04.218.3-9-g2e62cb8a-0ubuntu1~16.04.218.4-0ubuntu1~16.04.218.5-21-g8ee294d5-0ubuntu1~16.04.118.5-45-g3554ffe8-0ubuntu1~16.04.119.1-1-gbaa47854-0ubuntu1~16.04.119.2-24-ge7881d5c-0ubuntu1~16.04.119.2-36-g059d049c-0ubuntu1~16.04.119.2-36-g059d049c-0ubuntu2~16.04.119.3-41-gc4735dd3-0ubuntu1~16.04.119.4-33-gbb4131a2-0ubuntu1~16.04.120.2-45-g5f7825e2-0ubuntu1~16.04.120.3-2-g371b392c-0ubuntu1~16.04.120.4-0ubuntu1~16.04.120.4-0ubuntu1~16.04.2 |
None known |
cloud-initUbuntu:18.04:LTS |
before 20.2-45-g5f7825e2-0ubuntu1~18.04.1, plus listed versions 17.1-18-gd4f70470-0ubuntu117.1-25-g17a15f9e-0ubuntu1~17.10.117.1-25-g17a15f9e-0ubuntu117.1-27-geb292c18-0ubuntu117.1-41-g76243487-0ubuntu1 Show 35 moreShow less17.1-46-g7acc9e68-0ubuntu117.1-51-g05b2308a-0ubuntu117.1-53-ga5dc0f42-0ubuntu117.1-58-g703241a3-0ubuntu117.1-60-ga30a3bb5-0ubuntu117.2-1-g4089e20c-0ubuntu117.2-9-gdf24daa8-0ubuntu117.2-13-g6299e8d0-0ubuntu117.2-20-g32a6a176-0ubuntu117.2-25-gc03bdd3d-0ubuntu117.2-30-gf7deaf15-0ubuntu117.2-34-g644048e3-0ubuntu118.1-0ubuntu118.1-5-g40e77380-0ubuntu118.1-17-g97012fbb-0ubuntu118.1-23-gde34dc7c-0ubuntu118.1-26-g685f9901-0ubuntu118.1-35-ge0f644b7-0ubuntu118.1-35-ge0f644b7-0ubuntu218.2-0ubuntu118.2-4-g05926e48-0ubuntu118.2-4-g05926e48-0ubuntu218.2-9-g49b562c9-0ubuntu118.2-14-g6d48d265-0ubuntu118.2-27-g6ef92c98-0ubuntu1~18.04.118.3-9-g2e62cb8a-0ubuntu1~18.04.218.4-0ubuntu1~18.04.118.5-21-g8ee294d5-0ubuntu1~18.04.118.5-45-g3554ffe8-0ubuntu1~18.04.119.1-1-gbaa47854-0ubuntu1~18.04.119.2-24-ge7881d5c-0ubuntu1~18.04.119.2-36-g059d049c-0ubuntu1~18.04.119.2-36-g059d049c-0ubuntu2~18.04.119.3-41-gc4735dd3-0ubuntu1~18.04.119.4-33-gbb4131a2-0ubuntu1~18.04.1 |
20.2-45-g5f7825e2-0ubuntu1~18.04.1 |
cloud-initopenSUSE:Leap 15.1 |
before 19.4-lp151.2.15.1 | 19.4-lp151.2.15.1 |
cloud-initopenSUSE:Tumbleweed |
before 21.2-1.2 | 21.2-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8631 is a medium vulnerability (CVSS 5.5) in Canonical Cloud-init, published February 5, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in cloud-init 19.4-2.
References
github.com/canonical/cloud-init/pull/204
bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/1860795
lists.debian.org/debian-lts-announce/2020/02/msg00021.html
lists.opensuse.org/opensuse-security-announce/2020-03/msg00042.html
nvd.nist.gov/vuln/detail/CVE-2020-8631
Show 52 moreShow less
security-tracker.debian.org/tracker/CVE-2020-8631
advisories.mageia.org/MGASA-2020-0295.html
bugs.mageia.org/show_bug.cgi?id=26236
debian.org/lts/security/2020/dla-2113
access.redhat.com/errata/RHSA-2020:3898
bugzilla.redhat.com/show_bug.cgi?id=1574338
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3898.json
cve.org/CVERecord?id=CVE-2018-10896
suse.com/support/update/announcement/2020/suse-su-20200585-1
bugzilla.suse.com/1162936
ubuntu.com/security/CVE-2020-8631
Left out here: 5 versions. The JSON record has them.