CVE-2024-6219
Low
Description
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.
SeverityLow
CVSS3.8
Exploit probability—
ProductCanonical Lxd
PublishedDec 6, 2024
First seenDec 6, 2024
Weakness typeCWE-295CWE-295
How to fix
Update
- canonical lxd5.21.1 or later
- github.com/canonical/lxd0.0.0-20240403103450-0e7f2b5bf4d2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| canonical lxd | v < 5.21.1 | 5.21.1 |
| github.com/canonical/lxdGo | v < 0.0.0-20240403103450-0e7f2b5bf4d2 | 0.0.0-20240403103450-0e7f2b5bf4d2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.