Threats tagged 'ghsa-p3x5-mvmp-5f35'

A vulnerability in Canonical LXD's images export API allows unauthenticated attackers to determine the existence of projects by observing different HTTP error responses. Specifically, when querying images with wildcard fingerprints, the API returns a 500 error if multiple images match in an existing project, but a 404 error if the project does not exist. This discrepancy enables project enumeration without authentication. The vulnerability is fixed in LXD versions 5.21.4 and 6.5.