{
  "cveId": "CVE-2020-8903",
  "url": "https://patchblox.com/security/cve/CVE-2020-8903",
  "summary": "CVE-2020-8903 is fixed in 5 products on 1 platform, first by gce-compute-image-packages 20190801-0ubuntu1~18.04.1, released June 22, 2020. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "gce-compute-image-packages: A vulnerability in Google Cloud Platform\u0027s guest-oslogin versions between20190304 and 20200507 allows a user that is...",
  "description": "A vulnerability in Google Cloud Platform\u0027s guest-oslogin versions between20190304 and 20200507 allows a user that is only granted the role\u0022roles/compute.osLogin\u0022 to escalate privileges to root. Using theirmembership to the \u0022adm\u0022 group, users with this role are able to read theDHCP XID from the systemd journal. Using the DHCP XID, it is then possibleto set the IP address and hostname of the instance to any value, which isthen stored in /etc/hosts. An attacker can then pointmetadata.google.internal to an arbitrary IP address and impersonate the GCEmetadata server which make it is possible to instruct the OS Login PAMmodule to grant administrative privileges. All images created after2020-May-07 (20200507) are fixed, and if you cannot update, we recommendyou edit /etc/group/security.conf and remove the \u0022adm\u0022 user from the OSLogin entry.",
  "published": "2020-06-22T07:15:00Z",
  "severity": "Medium",
  "epss": 0.00315,
  "epssPercentile": 0.24603,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "gce-compute-image-packages",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "20190801-0ubuntu1~18.04.1",
      "fix": "gce-compute-image-packages 20190801-0ubuntu1~18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-gce-compute-image-packages-20190801-0ubuntu1-18.04.1",
      "released": "2020-06-22T07:15:00Z"
    },
    {
      "platform": "linux",
      "product": "gce-compute-image-packages",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20190801-0ubuntu4.1",
      "fix": "gce-compute-image-packages 20190801-0ubuntu4.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-gce-compute-image-packages-20190801-0ubuntu4.1",
      "released": "2020-06-22T07:15:00Z"
    },
    {
      "platform": "linux",
      "product": "gce-compute-image-packages",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "20190801-0ubuntu5",
      "fix": "gce-compute-image-packages 20190801-0ubuntu5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-gce-compute-image-packages-20190801-0ubuntu5",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "gce-compute-image-packages",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "20190801-0ubuntu5",
      "fix": "gce-compute-image-packages 20190801-0ubuntu5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-gce-compute-image-packages-20190801-0ubuntu5",
      "released": "2026-01-16T01:42:24Z"
    },
    {
      "platform": "linux",
      "product": "google-compute-engine",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "20190801-0ubuntu5",
      "fix": "google-compute-engine 20190801-0ubuntu5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-google-compute-engine-20190801-0ubuntu5",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "google-compute-engine",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "20190801-0ubuntu5",
      "fix": "google-compute-engine 20190801-0ubuntu5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-google-compute-engine-20190801-0ubuntu5",
      "released": "2026-01-16T01:42:24Z"
    },
    {
      "platform": "linux",
      "product": "google-compute-engine-oslogin",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "20190801-0ubuntu1~18.04.1",
      "fix": "google-compute-engine-oslogin 20190801-0ubuntu1~18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-google-compute-engine-oslogin-20190801-0ubuntu1-18.04.1",
      "released": "2020-06-22T07:15:00Z"
    },
    {
      "platform": "linux",
      "product": "google-compute-engine-oslogin",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20190801-0ubuntu4.1",
      "fix": "google-compute-engine-oslogin 20190801-0ubuntu4.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-google-compute-engine-oslogin-20190801-0ubuntu4.1",
      "released": "2020-06-22T07:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python-google-compute-engine",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "20190801-0ubuntu1~18.04.1",
      "fix": "python-google-compute-engine 20190801-0ubuntu1~18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-google-compute-engine-20190801-0ubuntu1-18.04.1",
      "released": "2020-06-22T07:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-google-compute-engine",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "20190801-0ubuntu1~18.04.1",
      "fix": "python3-google-compute-engine 20190801-0ubuntu1~18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python3-google-compute-engine-20190801-0ubuntu1-18.04.1",
      "released": "2020-06-22T07:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-google-compute-engine",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20190801-0ubuntu4.1",
      "fix": "python3-google-compute-engine 20190801-0ubuntu4.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-google-compute-engine-20190801-0ubuntu4.1",
      "released": "2020-06-22T07:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}