Critical · 1 source · latest 1d

Critical CVSS 10.0 flaw in Canonical LXD and MicroCloud allows client impersonation

CRITICAL · VULNERABILITYCanonicalredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

A serious flaw in software from Canonical, used to run virtual machines, lets an attacker pose as a trusted client without that client's secret key. The attacker needs network access to the system's web interface and the client's public certificate. The excerpt does not say how the flaw was fixed.

Like I’m new · Written by AI from 1 source · Wrong?

What to do

Check whether LXD or MicroCloud is deployed and whether its HTTPS API is reachable from untrusted networks.
Review Canonical's advisory for affected versions and apply the vendor fix once you have confirmed it.

Written by AI from the sources, checked against them

Read the full story at the source