CVE-2025-54290
CVE-2025-54290 · Project Existence Disclosure via Error Handling in LXD Image Export
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
CVSS 6.9 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
lxd
- Versions
- ≥ 6.0, < 6.5: Affected (semver)
- ≥ 5.21, < 5.21.4: Affected (semver)
Update to 5.21.4; Update to 6.5
incus Debian:13
- Versions
- 6.0.4-2
- 6.0.4-2+deb13u1~bpo12+1
- Affected ranges
- ECOSYSTEM: < 6.0.4-2+deb13u1
Update to 6.0.4-2+deb13u1
incus Debian:14
- Versions
- 6.0.4-2
- 6.0.4-3
- Affected ranges
- ECOSYSTEM: < 6.0.5-1
Update to 6.0.5-1
lxd Debian:12
- Versions
- 5.0.2+git20231211.1364ae4-1
- 5.0.2+git20231211.1364ae4-2
- 5.0.2+git20231211.1364ae4-3
- 5.0.2+git20231211.1364ae4-4
- 5.0.2+git20231211.1364ae4-5
- 5.0.2+git20231211.1364ae4-6
- 5.0.2+git20231211.1364ae4-7
- 5.0.2+git20231211.1364ae4-8
- 5.0.2+git20231211.1364ae4-9
- 5.0.2-5
- 5.0.2-5+deb12u1
- 5.0.2-5+deb12u2
- 5.0.2-5+deb12u3
- 5.0.2-5+deb12u4
- 5.0.2-5+deb12u5
- 5.0.2-5+deb12u6
- 5.0.2-6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Debian:13
- Versions
- 5.0.2+git20231211.1364ae4-9
- 5.0.2+git20231211.1364ae4-9+deb13u1
- 5.0.2+git20231211.1364ae4-9+deb13u2
- 5.0.2+git20231211.1364ae4-9+deb13u3
- 5.0.2+git20231211.1364ae4-9+deb13u4
- 5.0.2+git20231211.1364ae4-9+deb13u5
- 5.0.2+git20231211.1364ae4-9+deb13u6
- 5.0.2+git20231211.1364ae4-9+deb13u7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published