Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:43:17 +0000 EUVD-2026-254022 https://cve.radiocsirt.org/vuln/euvd-2026-254022 EUVD-2026-254022 https://cve.radiocsirt.org/vuln/euvd-2026-254022 fkie_cve-2025-54291 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54291 <p>Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.</p> <p>Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54291 GHSA-xch9-h8qw-85c7 — Canonical LXD Project Existence Determination Through Error Handling in Image Get Function https://cve.radiocsirt.org/vuln/ghsa-xch9-h8qw-85c7 <p><strong>Affected:</strong> Go: github.com/canonical/lxd</p> <p>### Impact The LXD /1.0/images endpoint is implemented as an AllowUntrusted API that requires no authentication, making it accessible to users without accounts. This API allows determining project existence through differences in HTTP status codes when accessed with the project parameter.</p> <p>https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/images.go#L63-L69</p> <p>This configuration allows access without authentication:</p> <p>https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/daemon.go#L924-L926</p> <p>This API returns a 404 error when accessing existing projects and a 403 error when accessing non-existent projects, allowing confirmation of project existence through this difference.</p> <p>The problematic implementation is shown below.</p> <p>First, in the error handling implementation of the imagesGet function below, project existence is checked within the `projectutils.ImageProject` function, and the err returned by the `ImageProject` function is directly returned to the user.</p> <p>https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/i mages.go#L1781-L1788</p> <p>When the project doesn&#39;t exist, the error is 404 (http.StatusNotFound), which is returned to the user:</p> <p>https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/db/cluster/projects.mapper.go#L237-L239</p> <p>On the other hand, when the project exists but the user lacks viewing permissions, the imagesGet function returns 403 (response.Forb…</p> <p><strong>Affected:</strong> Go: github.com/canonical/lxd</p> <p>### Impact The LXD /1.0/images endpoint is implemented as an AllowUntrusted API that requires no authentication, making it accessible to users without accounts. This API allows determining project existence through differences in HTTP status codes when accessed with the project parameter.</p> <p>https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/images.go#L63-L69</p> <p>This configuration allows access without authentication:</p> <p>https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/daemon.go#L924-L926</p> <p>This API returns a 404 error when accessing existing projects and a 403 error when accessing non-existent projects, allowing confirmation of project existence through this difference.</p> <p>The problematic implementation is shown below.</p> <p>First, in the error handling implementation of the imagesGet function below, project existence is checked within the `projectutils.ImageProject` function, and the err returned by the `ImageProject` function is directly returned to the user.</p> <p>https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/i mages.go#L1781-L1788</p> <p>When the project doesn&#39;t exist, the error is 404 (http.StatusNotFound), which is returned to the user:</p> <p>https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/db/cluster/projects.mapper.go#L237-L239</p> <p>On the other hand, when the project exists but the user lacks viewing permissions, the imagesGet function returns 403 (response.Forb…</p> https://cve.radiocsirt.org/vuln/ghsa-xch9-h8qw-85c7 openSUSE-SU-2025:15710-1 — govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media https://cve.radiocsirt.org/vuln/opensuse-su-2025:15710-1 <p>govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15710-1 Withdrawn: UBUNTU-CVE-2025-54291 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-54291 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:20.04:LTS: lxd</p> <p>Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:20.04:LTS: lxd</p> <p>Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-54291