En bref
- CVE-2015-1340 est une vulnérabilité ÉLEVÉE (CVSS 8.1) touchant github.com/lxc/lxd.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.90%, plus élevée que 59.6% des vulnérabilités.
- Correctif : mettre à jour vers 0.0.0-20151004155856-19c6961cc101 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| github.com/lxc/lxd Go | < 0.0.0-20151004155856-19c6961cc101
| 0.0.0-20151004155856-19c6961cc101
|
Description
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Specific Go Packages Affected
github.com/lxc/lxd/shared
NVD description
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free