critique
CVE-2026-28384
An improper sanitization of the compression_algorithm parameter in Can ...
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD.
Description
An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.23 | incus | 6.0.6-r0 |
| alpine 3.24 | incus | 6.0.6-r0 |
| alpine edge | incus | 6.0.6-r0 |
| debian 12 | lxd | 5.0.2-5+deb12u4 |
| debian 13 | incus, lxd | 6.0.4-2+deb13u5 et 1 autres |
| debian 14 | incus | 6.0.6-1 |
| echo | incus, lxd | 6.0.4-2+deb13u5 et 1 autres |
| rapidfort alpine 3.20 | incus, lxd | 6.0.6-r0 |
| rapidfort alpine 3.21 | incus, lxd | 6.0.6-r0 |
| rapidfort alpine 3.22 | incus, lxd | 6.0.6-r0 |
| rapidfort alpine 3.23 | incus | 6.0.6-r0 |
| rapidfort alpine 3.24 | lxd | pas de correctif indiqué |
Afficher les 21 entrées de 14 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.23 | incus | 6.0.6-r0 |
| alpine 3.24 | incus | 6.0.6-r0 |
| alpine edge | incus | 6.0.6-r0 |
| debian 12 | lxd | 5.0.2-5+deb12u4 |
| debian 13 | incus | 6.0.4-2+deb13u5 |
| debian 13 | lxd | 5.0.2+git20231211.1364ae4-9+deb13u4 |
| debian 14 | incus | 6.0.6-1 |
| echo | incus | 6.0.4-2+deb13u5 |
| echo | lxd | 5.0.2+git20231211.1364ae4-9+deb13u4 |
| rapidfort alpine 3.20 | incus | 6.0.6-r0 |
| rapidfort alpine 3.20 | lxd | pas de correctif indiqué |
| rapidfort alpine 3.21 | incus | 6.0.6-r0 |
| rapidfort alpine 3.21 | lxd | pas de correctif indiqué |
| rapidfort alpine 3.22 | incus | 6.0.6-r0 |
| rapidfort alpine 3.22 | lxd | pas de correctif indiqué |
| rapidfort alpine 3.23 | incus | 6.0.6-r0 |
| rapidfort alpine 3.24 | lxd | pas de correctif indiqué |
| rapidfort debian 12 | incus | 0:6.0.4-2+deb13u5, 0:6.0.6-1 |
| rapidfort debian 12 | lxd | 0:5.0.2+git20231211.1364ae4-9+deb13u4 |
| rapidfort debian 13 | incus | 0:6.0.4-2+deb13u5, 0:6.0.6-1 |
| rapidfort debian 13 | lxd | 0:5.0.2+git20231211.1364ae4-9+deb13u4 |
Références
- https://discourse.ubuntu.com/t/lxd-authenticated-remote-code-execution-fixes-available/78365
- https://github.com/canonical/lxd/commit/043696a13171ace7dd4c2b32d34ce039ab629052
- https://github.com/canonical/lxd/commit/7046979645c2ce1b63b2f9e60ddf6cbc4c4b78f9
- https://github.com/canonical/lxd/commit/b7b411caf5c4971bfe2386c72128f44d7e2aaf4f
- https://github.com/canonical/lxd/security/advisories/GHSA-4rmf-rcp8-2r9g