> CVE-2025-54290

« BACK_TO_HOME
PUBLISHED
2025-10-02 10:15
MODIFIED
2025-10-02 19:11
EPSS (Prob. Exploit)
0.34%
Top 72.8%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-p3x5-mvmp-5f35 MODERATE

Canonical LXD Project Existence Determination Through Error Handling in Image Export Function

AFFECTED PACKAGES:
GO / github.com/canonical/lxd
>= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41
Fixed in: 0.0.0-20250827065555-0494f5d47e41
GO / github.com/canonical/lxd
>= 6.0, < 6.5
Fixed in: 6.5
GO / github.com/canonical/lxd
>= 4.0, < 5.21.4
Fixed in: 5.21.4

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Project Existence Disclosure via Error Handling in LXD Image Export

AFFECTED PACKAGES:
Unknown / Unknown
144 versions affected
ALIASES:
GHSA-p3x5-mvmp-5f35, GO-2025-4002

> HISTORIQUE DES MODIFICATIONS

Première apparition
02/10/2025 10:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME