Dismissed
by @LeSuisse Activity log
- Created automatic suggestion
-
@pyrox0
removed
6 packages
- python312Packages.pylxd
- python313Packages.pylxd
- python314Packages.pylxd
- terraform-providers.lxd
- terraform-providers.terraform-lxd_lxd
- lxd-ui
- @LeSuisse dismissed
chmod race in doUidshiftIntoContainer
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
References
- https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 x_refsource_MISC
- https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 x_refsource_MISC x_transferred
- https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 x_refsource_MISC
- https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 x_refsource_MISC x_transferred
- https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 x_refsource_MISC
- https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 x_refsource_MISC x_transferred
Affected products
LXD
- <0.19-0ubuntu5
Matching in nixpkgs
pkgs.lxd-lts
Daemon based on liblxc offering a REST API to manage containers
pkgs.lxd-image-server
Creates and manages a simplestreams lxd image server on top of nginx
pkgs.lxd-unwrapped-lts
Daemon based on liblxc offering a REST API to manage containers
Ignored packages (6)
pkgs.lxd-ui
Web user interface for LXD
pkgs.python312Packages.pylxd
Library for interacting with the LXD REST API
pkgs.python313Packages.pylxd
Library for interacting with the LXD REST API
pkgs.python314Packages.pylxd
Library for interacting with the LXD REST API
pkgs.terraform-providers.lxd
None
Package maintainers
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>