CVE-2024-8287

Description

Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this.

Reserved 2024-08-28 | Published 2024-09-18 | Updated 2024-09-19 | Assigner canonical

Product status

1.17.0 before 1.23.1
affected

Credits

Simon Fels finder

Simon Fels remediation developer

References

discourse.ubuntu.com/t/anbox-cloud-1-23-1-has-been-released/48141 vendor-advisory

bugs.launchpad.net/anbox-cloud/+bug/2077570 issue-tracking

www.cve.org/CVERecord?id=CVE-2024-8287 issue-tracking

cve.org (CVE-2024-8287)

nvd.nist.gov (CVE-2024-8287)

Download JSON