Critical certificate validation flaw in LXD and Incus could let attackers take control of Linux hosts
CRITICAL · VULNERABILITYIncusredteam/daily · 1 source
- Severity
- Critical
- Highest CVSS
- 10.0
- Exploited
- Not known
- Sources
- 1
What happened
A serious flaw in software used to manage Linux virtual machines and containers could let an outsider take control without a password. The software wrongly trusts parts of a security certificate that the attacker controls. Updated versions fix the problem, and no active attacks have been reported.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Update Incus to version 7.6.0 or later.
- Update LXD to 4.0.15, 5.0.11, 5.21.9 or 6.10.1 for the relevant release branch.
- Restrict access to the HTTPS management listener to trusted hosts until patches are applied.
- Check installed versions against the relevant vendor advisory.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Companies