Summary
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon leaked
the Pro token to unprivileged users by passing the token as an argument
in plaintext. An attacker could use this issue to gain unauthorized access
to an Ubuntu Pro subscription. (CVE-2024-6388)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | ubuntu-advantage-desktop-daemon | 1.10.ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | ubuntu-advantage-desktop-daemon | 1.10.ubuntu0.22.04.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | ubuntu-advantage-desktop-daemon | 1.11ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ubuntu-advantage-desktop-daemon | 1.10.ubuntu0.16.04.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ubuntu-advantage-desktop-daemon | 1.10.ubuntu0.18.04.1~esm1 |
Vulnerabilities 1
-
Medium 5.9
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivi…
References
-
report
https://ubuntu.com/security/CVE-2024-6388