Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd ser

Description

Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.

Affected Products

References

• https://github.com/canonical/lxd/commit/d936c90d47cf0be1e9757df897f769e9887ebde1(Patch)
• https://github.com/canonical/lxd/pull/17738(Issue Tracking, Patch)
• https://github.com/canonical/lxd/security/advisories/GHSA-crmg-9m86-636r(Exploit, Mitigation, Vendor Advisory)