In breve
- CVE-2015-1340 è una vulnerabilità ALTO (CVSS 8.1) che riguarda github.com/lxc/lxd.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.90%, superiore al 59.6% delle vulnerabilità.
- Correzione: aggiornare a 0.0.0-20151004155856-19c6961cc101 o successiva.
| Package | Affected versions | Patched versions |
|---|
| github.com/lxc/lxd Go | < 0.0.0-20151004155856-19c6961cc101
| 0.0.0-20151004155856-19c6961cc101
|
Description
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Specific Go Packages Affected
github.com/lxc/lxd/shared
NVD description
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free