crítica
CVE-2026-28384
An improper sanitization of the compression_algorithm parameter in Can ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD.
Descripción
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.23 | incus | 6.0.6-r0 |
| alpine 3.24 | incus | 6.0.6-r0 |
| alpine edge | incus | 6.0.6-r0 |
| debian 12 | lxd | 5.0.2-5+deb12u4 |
| debian 13 | incus, lxd | 6.0.4-2+deb13u5 y 1 más |
| debian 14 | incus | 6.0.6-1 |
| echo | incus, lxd | 6.0.4-2+deb13u5 y 1 más |
| rapidfort alpine 3.20 | incus, lxd | 6.0.6-r0 |
| rapidfort alpine 3.21 | incus, lxd | 6.0.6-r0 |
| rapidfort alpine 3.22 | incus, lxd | 6.0.6-r0 |
| rapidfort alpine 3.23 | incus | 6.0.6-r0 |
| rapidfort alpine 3.24 | lxd | sin corrección indicada |
Mostrar las 21 entradas de 14 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.23 | incus | 6.0.6-r0 |
| alpine 3.24 | incus | 6.0.6-r0 |
| alpine edge | incus | 6.0.6-r0 |
| debian 12 | lxd | 5.0.2-5+deb12u4 |
| debian 13 | incus | 6.0.4-2+deb13u5 |
| debian 13 | lxd | 5.0.2+git20231211.1364ae4-9+deb13u4 |
| debian 14 | incus | 6.0.6-1 |
| echo | incus | 6.0.4-2+deb13u5 |
| echo | lxd | 5.0.2+git20231211.1364ae4-9+deb13u4 |
| rapidfort alpine 3.20 | incus | 6.0.6-r0 |
| rapidfort alpine 3.20 | lxd | sin corrección indicada |
| rapidfort alpine 3.21 | incus | 6.0.6-r0 |
| rapidfort alpine 3.21 | lxd | sin corrección indicada |
| rapidfort alpine 3.22 | incus | 6.0.6-r0 |
| rapidfort alpine 3.22 | lxd | sin corrección indicada |
| rapidfort alpine 3.23 | incus | 6.0.6-r0 |
| rapidfort alpine 3.24 | lxd | sin corrección indicada |
| rapidfort debian 12 | incus | 0:6.0.4-2+deb13u5, 0:6.0.6-1 |
| rapidfort debian 12 | lxd | 0:5.0.2+git20231211.1364ae4-9+deb13u4 |
| rapidfort debian 13 | incus | 0:6.0.4-2+deb13u5, 0:6.0.6-1 |
| rapidfort debian 13 | lxd | 0:5.0.2+git20231211.1364ae4-9+deb13u4 |
Referencias
- https://discourse.ubuntu.com/t/lxd-authenticated-remote-code-execution-fixes-available/78365
- https://github.com/canonical/lxd/commit/043696a13171ace7dd4c2b32d34ce039ab629052
- https://github.com/canonical/lxd/commit/7046979645c2ce1b63b2f9e60ddf6cbc4c4b78f9
- https://github.com/canonical/lxd/commit/b7b411caf5c4971bfe2386c72128f44d7e2aaf4f
- https://github.com/canonical/lxd/security/advisories/GHSA-4rmf-rcp8-2r9g