PT-2025-40334 · Canonical+2 · Lxd+2

Published 2025-10-02 · Updated 2025-11-17 · CVE-2025-54291

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Canonical LXD versions prior to 6.5 Canonical LXD versions prior to 5.21.4

Description An information disclosure issue exists in the images API of Canonical LXD. This allows unauthenticated remote attackers to determine project existence by observing differing HTTP status code responses.

Recommendations Update to a version prior to 6.5. Update to a version prior to 5.21.4.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2025-54291

DSA-6027-1

GHSA-XCH9-H8QW-85C7

GO-2025-4005

OPENSUSE-SU-2025:15710-1

Affected Products

Debian

Lxd

Red Os

References · 88

• https://github.com/canonical/lxd/security/advisories/GHSA-xch9-h8qw-85c7 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54291 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54291 · Security Note
• https://osv.dev/vulnerability/GHSA-xch9-h8qw-85c7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-54291 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54291 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54291 · Security Note
• https://osv.dev/vulnerability/DSA-6027-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-54291 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-54291 · Vendor Advisory
• https://github.com/canonical/lxd · Note
• https://suse.com/security/cve/CVE-2025-64102 · Note
• https://suse.com/security/cve/CVE-2025-62506 · Note