Threats tagged 'ghsa-jpmc-7p9c-4rxf'

LXD in PKI mode with a server.ca file present does not honor restrictions on TLS client certificates when the core.trust_ca_certificates option is set to false. This allows clients with restricted certificates to gain full access to LXD, bypassing intended privilege limitations. The issue arises from a logic flaw in how certificate restrictions are enforced in PKI mode. The vulnerability is considered low impact because PKI mode is not the default and users enabling it typically enable core.trust_ca_certificates, which grants full access to all CA-signed clients anyway.