Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that LXD incorrectly handled the handshake phase and the use of sequence numbers in SSH Binary Packet Protocol (BPP). If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to bypass integrity checks.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "binaries": [ { "lxd-tools-dbgsym": "2.0.11-0ubuntu1~16.04.4+esm1", "golang-github-lxc-lxd-dev": "2.0.11-0ubuntu1~16.04.4+esm1", "lxd-client": "2.0.11-0ubuntu1~16.04.4+esm1", "lxd-client-dbgsym": "2.0.11-0ubuntu1~16.04.4+esm1", "lxd-dbgsym": "2.0.11-0ubuntu1~16.04.4+esm1", "lxd": "2.0.11-0ubuntu1~16.04.4+esm1", "lxd-tools": "2.0.11-0ubuntu1~16.04.4+esm1", "lxc2": "2.0.11-0ubuntu1~16.04.4+esm1" } ] }
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "binaries": [ { "lxd": "3.0.3-0ubuntu1~18.04.2+esm1", "lxd-dbgsym": "3.0.3-0ubuntu1~18.04.2+esm1", "lxd-client": "3.0.3-0ubuntu1~18.04.2+esm1", "lxd-client-dbgsym": "3.0.3-0ubuntu1~18.04.2+esm1", "lxd-tools": "3.0.3-0ubuntu1~18.04.2+esm1", "lxd-tools-dbgsym": "3.0.3-0ubuntu1~18.04.2+esm1" } ] }