CVE-2025-54291
CVE-2025-54291 · Project existence disclosure in LXD images API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
CVSS 6.9 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
lxd
- Versions
- ≥ 6.0, < 6.5: Affected (semver)
- ≥ 5.21, < 5.21.4: Affected (semver)
Update to 5.21.4; Update to 6.5
incus Debian:13
- Versions
- 6.0.4-2
- 6.0.4-2+deb13u1~bpo12+1
- Affected ranges
- ECOSYSTEM: < 6.0.4-2+deb13u1
Update to 6.0.4-2+deb13u1
incus Debian:14
- Versions
- 6.0.4-2
- 6.0.4-3
- Affected ranges
- ECOSYSTEM: < 6.0.5-1
Update to 6.0.5-1
lxd Debian:12
- Versions
- 5.0.2+git20231211.1364ae4-1
- 5.0.2+git20231211.1364ae4-2
- 5.0.2+git20231211.1364ae4-3
- 5.0.2+git20231211.1364ae4-4
- 5.0.2+git20231211.1364ae4-5
- 5.0.2+git20231211.1364ae4-6
- 5.0.2+git20231211.1364ae4-7
- 5.0.2+git20231211.1364ae4-8
- 5.0.2+git20231211.1364ae4-9
- 5.0.2-5
- 5.0.2-5+deb12u1
- 5.0.2-5+deb12u2
- 5.0.2-5+deb12u3
- 5.0.2-5+deb12u4
- 5.0.2-5+deb12u5
- 5.0.2-5+deb12u6
- 5.0.2-6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
lxd Debian:13
- Versions
- 5.0.2+git20231211.1364ae4-9
- 5.0.2+git20231211.1364ae4-9+deb13u1
- 5.0.2+git20231211.1364ae4-9+deb13u2
- 5.0.2+git20231211.1364ae4-9+deb13u3
- 5.0.2+git20231211.1364ae4-9+deb13u4
- 5.0.2+git20231211.1364ae4-9+deb13u5
- 5.0.2+git20231211.1364ae4-9+deb13u6
- 5.0.2+git20231211.1364ae4-9+deb13u7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published