Description (CNA)
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Canonical / LXD | affected 5.21.0 before 5.21.8; affected 6.0 before 6.10; affected 4.0 before 5.0.10 |
CWE
CWE-862
References
- https://github.com/canonical/lxd/security/advisories/GHSA-j7p3-5g2v-69j8
- https://github.com/canonical/lxd/pull/19003
- https://github.com/canonical/lxd/pull/19002
- https://github.com/canonical/lxd/pull/19001
- https://github.com/canonical/lxd/pull/18987
ADP enrichment
No English description supplied.
No references supplied.