Nixpkgs security tracker
by @LeSuisse Activity log
- Created suggestion
-
@pyrox0
ignored
6 packages
- python312Packages.pylxd
- python313Packages.pylxd
- python314Packages.pylxd
- terraform-providers.lxd
- terraform-providers.terraform-lxd_lxd
- lxd-ui
- @LeSuisse dismissed
chmod race in doUidshiftIntoContainer
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
References
-
https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 x_refsource_MISCx_transferred
Affected products
LXD
- <0.19-0ubuntu5
Matching in nixpkgs
pkgs.lxd-lts
None
pkgs.lxd-image-server
Creates and manages a simplestreams lxd image server on top of nginx
pkgs.lxd-unwrapped-lts
None
Ignored packages (6)
pkgs.lxd-ui
None
pkgs.python312Packages.pylxd
None
pkgs.python313Packages.pylxd
Library for interacting with the LXD REST API
pkgs.python314Packages.pylxd
Library for interacting with the LXD REST API
pkgs.terraform-providers.lxd
None
pkgs.terraform-providers.terraform-lxd_lxd
None
Package maintainers
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>