7.3
Élevée
CVE-2020-11933 cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every…
Description
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.
Produits et versions touchés
Autres CVE de snapd
Les 9 CVE de snapd →
CVE-2024-29069
In snapd versions prior to 2.62, snapd failed to properly check the
destination of symbolic links when extracting a snap
4.8
Moyenne
CVE-2024-29068
In snapd versions prior to 2.62, snapd failed to properly check the file
type when extracting a snap
5.8
Moyenne
CVE-2024-1724
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict…
6.3
Moyenne
CVE-2020-27352
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify…
9.3
Critique