Six critical 9.9-CVSS vulnerabilities were found in Canonical's LXD today only

Overview · canonical/lxd · GitHub

//repos/security/overview" data-turbo-transient="true" />

Search or jump to...

Search code, repositories, users, issues, pull requests...

-->

Clear

Search syntax tips

Provide feedback

--> We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Cancel

Submit feedback

Saved searches

Use saved searches to filter your results more quickly

-->

Name

Query

To see all available qualifiers, see our documentation.

Cancel

Create saved search

//repos/security/overview;ref_cta:Sign up;ref_loc:header logged out"}" Sign up

Appearance settings

Resetting focus

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

Uh oh!

There was an error while loading. Please reload this page.

canonical

lxd

Public

Notifications You must be signed in to change notification settings

Fork 1k

Star 4.8k

Security: canonical/lxd

Security

Report a vulnerability

SECURITY.md

Security policy

Supported versions

LXD has two types of releases:

Feature releases

LTS releases

For feature releases, only the latest one is supported, and we usually don't do point releases. Instead, users are expected to wait until the next feature release.

For LTS releases, we do periodic bugfix releases that include an accumulation of bugfixes from the feature releases. Such bugfix releases do not include new features.

What qualifies as a security issue

We don't consider privileged containers to be root safe, so any exploit allowing someone to escape them will not qualify as a security issue. This doesn't mean that we're not interested in preventing such escapes, but we simply do not consider such containers to be root safe.

Unprivileged container escapes are certainly something we'd consider a security issue, especially if somehow facilitated by LXD.

Reporting a vulnerability

The easiest way to report a security issue is through GitHub. See Privately reporting a security vulnerability for instructions.

The LXD GitHub admins will be notified of the issue and will work with you to determine whether the issue qualifies as a security issue and, if so, in which component. We will then handle figuring out a fix, getting a CVE assigned and coordinating the release of the fix to the various Linux distributions.

The Ubuntu Security disclosure and embargo policy contains more information about what you can expect when you contact us, and what we expect from you.

Project restriction bypass in instance copy across projects

GHSA-qx75-2p3r-pwm5