Description
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 12 | | =5.0.2+git20231211.1364ae4-1 || =5.0.2+git20231211.1364ae4-2 || =5.0.2+git20231211.1364ae4-3 || =5.0.2+git20231211.1364ae4-4 || =5.0.2+git20231211.1364ae4-5 || =5.0.2+git20231211.1364ae4-6 || =5.0.2+git20231211.1364ae4-7 || =5.0.2+git20231211.1364ae4-8 || =5.0.2+git20231211.1364ae4-9 || =5.0.2-5 || =5.0.2-5+deb12u1 || =5.0.2-5+deb12u2 || =5.0.2-5+deb12u3 || =5.0.2-5+deb12u4 || =5.0.2-5+deb12u5 || =5.0.2-5+deb12u6 || =5.0.2-6 |
debian 13 | | =5.0.2+git20231211.1364ae4-9 || =5.0.2+git20231211.1364ae4-9+deb13u1 || =5.0.2+git20231211.1364ae4-9+deb13u2 || =5.0.2+git20231211.1364ae4-9+deb13u3 || =5.0.2+git20231211.1364ae4-9+deb13u4 || =5.0.2+git20231211.1364ae4-9+deb13u5 || =5.0.2+git20231211.1364ae4-9+deb13u6 || =5.0.2+git20231211.1364ae4-9+deb13u7 |
