Search CVE reports

1 – 10 of 20 results

Detailed view

Sort by:

CVE-2025-22869

Medium priority

Needs evaluation

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

3 affected packages

golang-go.crypto, lxd, snapd

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
golang-go.crypto	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
lxd	Not in release	Not in release	Not affected	Needs evaluation	Needs evaluation
snapd	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2024-45341

Medium priority

Needs evaluation

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only...

18 affected packages

golang, golang-1.10, golang-1.13, golang-1.14, golang-1.16...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
golang	Not in release	Not in release	Not in release	—	—
golang-1.10	Not in release	Not in release	Not in release	Needs evaluation	Needs evaluation
golang-1.13	Not in release	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
golang-1.14	Not in release	Not in release	Needs evaluation	—	—
golang-1.16	Not in release	Not in release	Needs evaluation	Needs evaluation	—
golang-1.17	Not in release	Needs evaluation	Not in release	—	—
golang-1.18	Not in release	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
golang-1.20	Not in release	Needs evaluation	Needs evaluation	—	—
golang-1.21	Needs evaluation	Needs evaluation	Needs evaluation	—	—
golang-1.22	Needs evaluation	Needs evaluation	Needs evaluation	—	—
golang-1.23	Needs evaluation	Needs evaluation	Not in release	—	—
golang-1.24	Not in release	Not in release	Not in release	—	—
golang-1.6	Not in release	Not in release	Not in release	—	Needs evaluation
golang-1.8	Not in release	Not in release	Not in release	Needs evaluation	—
golang-1.9	Not in release	Not in release	Not in release	Needs evaluation	—
golang-go.crypto	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
lxd	Not in release	Not in release	Not affected	Needs evaluation	Needs evaluation
snapd	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2024-45338

Medium priority

Some fixes available 10 of 11

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

7 affected packages

adsys, containerd, golang-golang-x-net, golang-golang-x-net-dev, google-guest-agent...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
adsys	Fixed	Fixed	Fixed	—	—
containerd	Not affected	Not affected	Not affected	Not affected	Not affected
golang-golang-x-net	Fixed	Fixed	Not in release	—	—
golang-golang-x-net-dev	Not in release	Not in release	Fixed	Fixed	Fixed
google-guest-agent	Not affected	Not affected	Not affected	Not affected	Not affected
juju-core	Not in release	Not in release	Not in release	—	Fixed
lxd	Not in release	Not in release	Not affected	Not affected	Not affected

CVE-2024-45337

Medium priority

Needs evaluation

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says...

3 affected packages

golang-go.crypto, lxd, snapd

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
golang-go.crypto	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
lxd	Not in release	Not in release	Not affected	Needs evaluation	Needs evaluation
snapd	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2024-6219

Medium priority

Needs evaluation

Mark Laing discovered in LXD’s PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.

1 affected package

lxd

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
lxd	Not in release	Not in release	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2024-6156

Medium priority

Needs evaluation

Mark Laing discovered that LXD’s PKI mode, until version 5.21.2, could be bypassed if the client’s certificate was present in the trust store.

1 affected package

lxd

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
lxd	Not in release	Not in release	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2023-49721

Medium priority

Not affected

An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.

1 affected package

lxd

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
lxd	Not in release	Not in release	Not affected	Not affected	Not affected

CVE-2023-48795

Medium priority

Some fixes available 34 of 77

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation...

13 affected packages

dropbear, filezilla, golang-go.crypto, libssh, libssh2...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
dropbear	Needs evaluation	Fixed	Fixed	Fixed	Needs evaluation
filezilla	Fixed	Fixed	Fixed	Not affected	Not affected
golang-go.crypto	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
libssh	Not affected	Fixed	Fixed	Not affected	Not affected
libssh2	Not affected	Not affected	Not affected	Not affected	Not affected
lxd	Not in release	Not in release	Not affected	Fixed	Fixed
openssh	Fixed	Fixed	Fixed	Fixed	Fixed
openssh-ssh1	Ignored	Ignored	Ignored	Ignored	Not in release
paramiko	Fixed	Fixed	Fixed	Needs evaluation	Needs evaluation
proftpd-dfsg	Not affected	Not affected	Fixed	Needs evaluation	Needs evaluation
putty	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
python-asyncssh	Fixed	Fixed	Fixed	Ignored	Ignored
snapd	Not affected	Not affected	Not affected	Not affected	Not affected

CVE-2021-43565

Medium priority

Needs evaluation

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

3 affected packages

golang-go.crypto, lxd, snapd

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
golang-go.crypto	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
lxd	—	—	Not affected	Not affected	Not affected
snapd	Not affected	Not affected	Not affected	Not affected	Not affected

CVE-2022-27191

Medium priority

Needs evaluation

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

3 affected packages

golang-go.crypto, lxd, snapd

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
golang-go.crypto	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
lxd	—	Not in release	Not affected	Not affected	Not affected
snapd	Not affected	Not affected	Not affected	Not affected	Not affected

Export to JSON

Results by page: