Description
An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 13 | python-virtualbmc | 1.2.0-2.el7ost | RHSA-2022:8896 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | sushy-tools | < 0.21.1 | 0.21.1 | GHSA-5pj3-6fqm-8m7m |
| PyPI | virtualbmc | < 3.0.0 | 3.0.0 | GHSA-5pj3-6fqm-8m7m |
Advisories 2
- RHSA-2022:8896 Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 (python-virtualbmc) security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2022-2272 Red Hat OpenStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 8, 2022