Low severity3.8NVD Advisory· Published Dec 6, 2024· Updated Jun 17, 2026

CVE-2024-6219

Description

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/canonical/lxdGo	< 0.0.0-20240403103450-0e7f2b5bf4d2	0.0.0-20240403103450-0e7f2b5bf4d2

Affected products

Canonical/Lxd2 versions
cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*range: <5.21.1
- (no CPE)range: 0
ghsa-coords2 versions
pkg:golang/github.com/canonical/lxd pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
< 0.0.0-20240403103450-0e7f2b5bf4d2+ 1 more
- (no CPE)range: < 0.0.0-20240403103450-0e7f2b5bf4d2
- (no CPE)range: < 0.0.20241209T183251-1.1

Patches

Vulnerability mechanics

References

github.com/canonical/lxd/security/advisories/GHSA-jpmc-7p9c-4rxfnvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-jpmc-7p9c-4rxfghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-6219ghsaADVISORY
www.cve.org/CVERecordnvdThird Party AdvisoryWEB
github.com/canonical/lxd/commit/5cdc9a35b9c51e981b1e70330bde0413ccacc7fdghsaWEB
github.com/canonical/lxd/pull/12313ghsaWEB
pkg.go.dev/vuln/GO-2024-3313ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.247
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000