kritisch
CVE-2026-28384
An improper sanitization of the compression_algorithm parameter in Can ...
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD.
Beschreibung
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.23 | incus | 6.0.6-r0 |
| alpine 3.24 | incus | 6.0.6-r0 |
| alpine edge | incus | 6.0.6-r0 |
| debian 12 | lxd | 5.0.2-5+deb12u4 |
| debian 13 | incus, lxd | 6.0.4-2+deb13u5 und 1 weitere |
| debian 14 | incus | 6.0.6-1 |
| echo | incus, lxd | 6.0.4-2+deb13u5 und 1 weitere |
| rapidfort alpine 3.20 | incus, lxd | 6.0.6-r0 |
| rapidfort alpine 3.21 | incus, lxd | 6.0.6-r0 |
| rapidfort alpine 3.22 | incus, lxd | 6.0.6-r0 |
| rapidfort alpine 3.23 | incus | 6.0.6-r0 |
| rapidfort alpine 3.24 | lxd | kein Fix angegeben |
Alle 21 Einträge aus 14 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.23 | incus | 6.0.6-r0 |
| alpine 3.24 | incus | 6.0.6-r0 |
| alpine edge | incus | 6.0.6-r0 |
| debian 12 | lxd | 5.0.2-5+deb12u4 |
| debian 13 | incus | 6.0.4-2+deb13u5 |
| debian 13 | lxd | 5.0.2+git20231211.1364ae4-9+deb13u4 |
| debian 14 | incus | 6.0.6-1 |
| echo | incus | 6.0.4-2+deb13u5 |
| echo | lxd | 5.0.2+git20231211.1364ae4-9+deb13u4 |
| rapidfort alpine 3.20 | incus | 6.0.6-r0 |
| rapidfort alpine 3.20 | lxd | kein Fix angegeben |
| rapidfort alpine 3.21 | incus | 6.0.6-r0 |
| rapidfort alpine 3.21 | lxd | kein Fix angegeben |
| rapidfort alpine 3.22 | incus | 6.0.6-r0 |
| rapidfort alpine 3.22 | lxd | kein Fix angegeben |
| rapidfort alpine 3.23 | incus | 6.0.6-r0 |
| rapidfort alpine 3.24 | lxd | kein Fix angegeben |
| rapidfort debian 12 | incus | 0:6.0.4-2+deb13u5, 0:6.0.6-1 |
| rapidfort debian 12 | lxd | 0:5.0.2+git20231211.1364ae4-9+deb13u4 |
| rapidfort debian 13 | incus | 0:6.0.4-2+deb13u5, 0:6.0.6-1 |
| rapidfort debian 13 | lxd | 0:5.0.2+git20231211.1364ae4-9+deb13u4 |
Referenzen
- https://discourse.ubuntu.com/t/lxd-authenticated-remote-code-execution-fixes-available/78365
- https://github.com/canonical/lxd/commit/043696a13171ace7dd4c2b32d34ce039ab629052
- https://github.com/canonical/lxd/commit/7046979645c2ce1b63b2f9e60ddf6cbc4c4b78f9
- https://github.com/canonical/lxd/commit/b7b411caf5c4971bfe2386c72128f44d7e2aaf4f
- https://github.com/canonical/lxd/security/advisories/GHSA-4rmf-rcp8-2r9g