Simon Fels

Name of the Vulnerable Software and Affected Versions: Anbox Management Service versions 1.17.0 through 1.23.0 Description: The issue concerns the failure to validate the TLS certificate provided by the Anbox Stream Agent. This could be exploited by an attacker who can intercept the communication between the Anbox Stream Agent and the Anbox Management Service from within an internal network. Recommendations: For versions 1.17.0 through 1.23.0, consider implementing additional network security measures to prevent machine-in-the-middle attacks until a patch is available. As a temporary workaround, restrict access to the internal network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.