> CVE-2025-54291

« BACK_TO_HOME
PUBLISHED
2025-10-02 10:15
MODIFIED
2025-10-02 19:11
EPSS (Prob. Exploit)
0.39%
Top 67.1%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-xch9-h8qw-85c7 MODERATE

Canonical LXD Project Existence Determination Through Error Handling in Image Get Function

AFFECTED PACKAGES:
GO / github.com/canonical/lxd
>= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41
Fixed in: 0.0.0-20250827065555-0494f5d47e41
GO / github.com/canonical/lxd
>= 6.0, < 6.5
Fixed in: 6.5
GO / github.com/canonical/lxd
>= 4.0, < 5.21.4
Fixed in: 5.21.4

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Project existence disclosure in LXD images API

AFFECTED PACKAGES:
Unknown / Unknown
43 versions affected
ALIASES:
GHSA-xch9-h8qw-85c7, GO-2025-4005

> HISTORIQUE DES MODIFICATIONS

Première apparition
02/10/2025 10:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME