LXD could be made to bypass integrity checks if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-6738-1 April 22, 2024 lxd vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) Summary: LXD could be made to bypass integrity checks if it received specially crafted input. Software Description: - lxd: Container hypervisor based on LXC Details: Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that LXD incorrectly handled the handshake phase and the use of sequence numbers in SSH Binary Packet Protocol (BPP). If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to bypass integrity checks. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS (Available with Ubuntu Pro): lxd 3.0.3-0ubuntu1~18.04.2+esm1 lxd-client 3.0.3-0ubuntu1~18.04.2+esm1 lxd-tools 3.0.3-0ubuntu1~18.04.2+esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): golang-github-lxc-lxd-dev 2.0.11-0ubuntu1~16.04.4+esm1 lxc2 2.0.11-0ubuntu1~16.04.4+esm1 lxd 2.0.11-0ubuntu1~16.04.4+esm1 lxd-client 2.0.11-0ubuntu1~16.04.4+esm1 lxd-tools 2.0.11-0ubuntu1~16.04.4+esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6738-1 CVE-2023-48795 . Critical flaw detected in LXD affects Ubuntu 16.04 and 18.04 LTS; please prioritize your updates now.. LXD Security Advisory,Ubuntu Integrity Bypass, Remote Attack Patch. . Severity: Important. LinuxSecurity.com Team
Fix build for all versions, previous try wasn't correct and back with dpkg-perl-libexecdir.patch Security fix for CVE-2014-8625 and Security fix for CVE-2015-0840. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-7296 2015-05-01 11:27:10 -------------------------------------------------------------------------------- Name : dpkg Product : Fedora 21 Version : 1.16.16 Release : 5.fc21 URL : https://tracker.debian.org/pkg/dpkg Summary : Package maintenance system for Debian Linux Description : This package contains the tools (including dpkg-source) required to unpack, build and upload Debian source packages. This package also contains the programs dpkg which used to handle the installation and removal of packages on a Debian system. This package also contains dselect, an interface for managing the installation and removal of packages on the system. dpkg and dselect will certainly be non-functional on a rpm-based system because packages dependencies will likely be unmet. -------------------------------------------------------------------------------- Update Information: Fix build for all versions, previous try wasn't correct and back with dpkg-perl-libexecdir.patch Security fix for CVE-2014-8625 and Security fix for CVE-2015-0840 -------------------------------------------------------------------------------- ChangeLog: * Sun Apr 26 2015 Sérgio Basto - 1.16.16-5 - Fix build for all versions, previous try wasn't correct and back with dpkg-perl-libexecdir.patch . - Added dpkg-perl-libexecdir.epel6.patch just for fix epel
Get the latest Linux and open source security news straight to your inbox.