CVE-2024-6156

CWE-295 — Improper Certificate Validation7 documents5 sources
Severity
3.8LOW
EPSS
0.0%
top 88.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Canonical Ltd. LXDGithub.com Canonical/lxdCanonical LXD
Timeline
PublishedDec 6
Latest updateDec 9

Description

Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NExploitability: 2.0 | Impact: 1.4

Affected Packages4 packages

▶NVDcanonical/lxd4.0.0 — 4.0.10+2
▶CVEListV5canonical_ltd./lxd4.0 — 4.0.10+3
▶Gogithub.com/canonical/lxd< 0.0.0-20240708073652-5a492a3f0036
▶Debianincus< 6.0.3-1+1

🔴Vulnerability Details

5
OSV
CA certificate sign check bypass in github.com/canonical/lxd↗2024-12-09
▶
OSV
lxd CA certificate sign check bypass↗2024-12-09
▶
GHSA
lxd CA certificate sign check bypass↗2024-12-09
▶
OSV
CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5↗2024-12-06
▶
CVEList
CVE-2024-6156: Mark Laing discovered that LXD's PKI mode, until version 5↗2024-12-05
▶

📋Vendor Advisories

1
Debian
CVE-2024-6156: incus - Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypass...↗2024
▶
CVE-2024-6156 (LOW CVSS 3.8) | Mark Laing discovered that LXD's PK | cvebase.io