Owais Lone

**Name of the Vulnerable Software and Affected Versions** BuildKit (affected versions not specified) **Description** A crafted message in the low-level build API allows an attacker to remove the contents of the `/tmp` directory. This occurs because an action intended to delete files within the build container rootfs can escape and affect the actual host temporary directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Canonical MicroCeph versions from the squid and tentacle track **Description** A path traversal issue exists in the remote-import API. Users possessing a join token or a trusted cluster mTLS certificate, such as enrolled cluster members, can manipulate files within an imported remote cluster inside the `/var/snap/microceph` confinement. This flaw can lead to daemon disruption and pollution of the cluster state. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.