CVE-2024-8287
- State
- Published
- Severity
- 7.5 High
- Published
- Sep 18, 2024
- Updated
- Sep 19, 2024
- Reserved
- Aug 28, 2024
Description
Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | canonical |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Anbox CloudCanonical Ltd. |
|
References
- https://discourse.ubuntu.com/t/anbox-cloud-1-23-1-has-been-released/48141vendor-advisory
- https://bugs.launchpad.net/anbox-cloud/+bug/2077570issue-tracking
- https://www.cve.org/CVERecord?id=CVE-2024-8287issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.