Incus leader says license prevents checking whether 18 flaws affect LXD

First reported by RuntimeWire at · Updated · 2 sources

Stéphane Graber says LXD’s AGPLv3 license prevents Incus maintainers from reading its code, according to RuntimeWire. The publication says seven of the 18 advisories remained Incus-only, mostly because LXD had separate reports. Cyber Security News reports that a certificate validation flaw in both projects could let remote attackers bypass login checks and control clusters and managed virtual machines.

  • The certificate flaw affects the HTTPS management listener, according to Cyber Security News.

Covered by 2 publishers within 7 hours of the first report.

Reporting2

RuntimeWire Incus maintainers can't check whether their 18 new flaws affect LXD, project leader says · Emerson Redding
Cyber Security News Critical Certificate Validation Flaw in LXD and Incus Could Give Hackers Control of Linux Hosts · Guru Baran