CVE-2022-44020: Fedoraproject Fedora

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Affected products

• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Opendev Sushy-Tools: before 0.21.1 (fixed in 0.21.1)
• Opendev Virtualbmc: before 3.0.0 (fixed in 3.0.0)

Published 2022-10-30. Last modified 2026-06-17.