Description
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 12 | | =5.0.2+git20231211.1364ae4-1 || =5.0.2+git20231211.1364ae4-2 || =5.0.2+git20231211.1364ae4-3 || =5.0.2+git20231211.1364ae4-4 || =5.0.2+git20231211.1364ae4-5 || =5.0.2+git20231211.1364ae4-6 || =5.0.2+git20231211.1364ae4-7 || =5.0.2+git20231211.1364ae4-8 || =5.0.2+git20231211.1364ae4-9 || =5.0.2-5 || =5.0.2-5+deb12u1 || =5.0.2-5+deb12u2 || =5.0.2-5+deb12u3 || =5.0.2-5+deb12u4 || =5.0.2-5+deb12u5 || =5.0.2-5+deb12u6 || =5.0.2-6 |
debian 13 | | =5.0.2+git20231211.1364ae4-9 || =5.0.2+git20231211.1364ae4-9+deb13u1 || =5.0.2+git20231211.1364ae4-9+deb13u2 || =5.0.2+git20231211.1364ae4-9+deb13u3 || =5.0.2+git20231211.1364ae4-9+deb13u4 || =5.0.2+git20231211.1364ae4-9+deb13u5 || =5.0.2+git20231211.1364ae4-9+deb13u6 || =5.0.2+git20231211.1364ae4-9+deb13u7 |
