Search CVE reports
91 – 100 of 110 results
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.
1 affected package
lxd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| lxd | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
1 affected package
lxd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| lxd | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.
1 affected package
lxd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| lxd | — | Not in release | Not in release | Not affected | Not affected |
Some fixes available 46 of 98
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation...
13 affected packages
dropbear, golang-go.crypto, putty, proftpd-dfsg, filezilla...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dropbear | Needs evaluation | Needs evaluation | Fixed | Fixed | Fixed |
| golang-go.crypto | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| putty | Not affected | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| proftpd-dfsg | Needs evaluation | Not affected | Not affected | Fixed | Needs evaluation |
| filezilla | Fixed | Fixed | Fixed | Fixed | Not affected |
| libssh | Not affected | Not affected | Fixed | Fixed | Not affected |
| libssh2 | Not affected | Not affected | Not affected | Not affected | Not affected |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
| openssh | Fixed | Fixed | Fixed | Fixed | Fixed |
| openssh-ssh1 | Ignored | Ignored | Ignored | Ignored | Ignored |
| paramiko | Fixed | Fixed | Fixed | Fixed | Needs evaluation |
| python-asyncssh | Fixed | Fixed | Fixed | Fixed | Ignored |
| snapd | Not affected | Not affected | Not affected | Not affected | Not affected |
Some fixes available 8 of 12
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
7 affected packages
golang-golang-x-net, containerd, golang-golang-x-net-dev, adsys, google-guest-agent...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Not affected | Not affected | Fixed | Not in release | Not in release |
| containerd | Not affected | Not affected | Not affected | Not affected | Not affected |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Fixed | Fixed |
| adsys | Not affected | Not affected | Not affected | Fixed | — |
| google-guest-agent | Not affected | Not affected | Not affected | Not affected | Not affected |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
Some fixes available 23 of 39
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
20 affected packages
golang-golang-x-net, containerd, golang-1.13, adsys, golang...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Not affected | Not affected | Fixed | Not in release | Not in release |
| containerd | Not affected | Not affected | Not affected | Not affected | Not affected |
| golang-1.13 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| adsys | Not affected | Not affected | Not affected | Fixed | — |
| golang | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.10 | Not in release | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.14 | Not in release | Not in release | Not in release | Vulnerable | Not in release |
| golang-1.16 | Not in release | Not in release | Not in release | Vulnerable | Vulnerable |
| golang-1.17 | Not in release | Not in release | Fixed | Not in release | Not in release |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.19 | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.20 | Not in release | Not in release | Not affected | Not affected | Not in release |
| golang-1.21 | Not in release | Not affected | Not affected | Not affected | Not in release |
| golang-1.6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| golang-1.8 | Not in release | Not in release | Not in release | Not in release | Vulnerable |
| golang-1.9 | Not in release | Not in release | Not in release | Not in release | Vulnerable |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Fixed | Fixed |
| google-guest-agent | Fixed | Fixed | Fixed | Fixed | Fixed |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
Some fixes available 26 of 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
17 affected packages
golang-1.13, golang-1.14, golang-1.16, golang-1.17, golang-1.18...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-1.13 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.14 | — | — | Not in release | Vulnerable | Not in release |
| golang-1.16 | — | — | Not in release | Fixed | Fixed |
| golang-1.17 | — | — | Vulnerable | Not in release | Not in release |
| golang-1.18 | Not in release | Not in release | Fixed | Fixed | Fixed |
| golang-1.8 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.9 | — | — | Not in release | Not in release | Vulnerable |
| golang-golang-x-net | Not affected | Not affected | Fixed | Not in release | Not in release |
| google-guest-agent | Fixed | Fixed | Fixed | Fixed | Needs evaluation |
| containerd | Not affected | Not affected | Not affected | Not affected | Not affected |
| adsys | Not affected | Not affected | Not affected | Fixed | — |
| golang | — | — | Not in release | Not in release | Not in release |
| golang-1.10 | — | — | Not in release | Not in release | Vulnerable |
| golang-1.6 | — | — | Not in release | Not in release | Not in release |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Fixed | Fixed |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Not affected | Fixed |
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
3 affected packages
golang-go.crypto, lxd, snapd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| lxd | — | — | — | Not affected | Not affected |
| snapd | Not affected | Not affected | Not affected | Not affected | Not affected |
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
3 affected packages
golang-go.crypto, lxd, snapd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| lxd | — | — | Not in release | Not affected | Not affected |
| snapd | Not affected | Not affected | Not affected | Not affected | Not affected |
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
3 affected packages
golang-go.crypto, lxd, snapd
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| lxd | — | — | — | Not affected | Needs evaluation |
| snapd | Not affected | Not affected | Not affected | Not affected | Not affected |