Back to Database
Status published
Unknown
CVE-2022-44020
An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and...
Vulnerability Description
An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-44020
Credits & Attribution
No credits recorded in the NVD database.
References
- https://storyboard.openstack.org/#%21/story/2010382
- https://review.opendev.org/c/openstack/virtualbmc/+/862620
- https://review.opendev.org/c/openstack/sushy-tools/+/862625
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEQVJF3OQGSDCSQTQQSC54JEGLMSNB4Q/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMSUGS4B6EBRHBJMTRXL5RIKJTZTEMJC/
Affected Vendor
opendev
View all reports →Affected Software
sushy-tools, virtualbmc, fedora
Vulnerable Versions:
0, 35, 36, 37
Timeline
Official Publish:
October 29th, 2022
Last Modified:
May 7th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.