CVE-2017-18641
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature...
CVE-2017-18641 is a high vulnerability (CVSS 8.1) in Linuxcontainers Lxc, published February 10, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in lxc 1:3.0.3-1.
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
- Record
CVE-2017-18641- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
- Record
CVE-2017-18641- Updated
- 2026-11-02
EUVDEUVD-2017-9732 No score
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
- Record
EUVD-2017-9732- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rv6g-hrqv-7f3p No score
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature...
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
- Record
GHSA-rv6g-hrqv-7f3p- Updated
- 2026-11-02
OSV
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
- Record
CVE-2017-18641- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-18641
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
- Record
DEBIAN-CVE-2017-18641- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-18641
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
- Record
UBUNTU-CVE-2017-18641- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lxcDebian:12 |
before 1:3.0.3-1 | 1:3.0.3-1 |
lxcDebian:13 |
before 1:3.0.3-1 | 1:3.0.3-1 |
lxcDebian:14 |
before 1:3.0.3-1 | 1:3.0.3-1 |
lxc-templatesDebian:12 |
All versions, plus listed versions 3.0.4.48.g4765da8-13.0.4.48.g4765da8-1+deb12u13.0.4.48.g4765da8-23.0.4.79.g84b0597-13.0.4.89.gc128b96-13.0.4.95.g15f7c83-13.0.4.95.g15f7c83-23.0.4.97.ga9feb21-1 |
None known |
lxc-templatesDebian:13 |
All versions, plus listed versions 3.0.4.89.gc128b96-13.0.4.95.g15f7c83-13.0.4.95.g15f7c83-23.0.4.97.ga9feb21-1 |
None known |
lxc-templatesDebian:14 |
All versions, plus listed versions 3.0.4.89.gc128b96-13.0.4.95.g15f7c83-13.0.4.95.g15f7c83-23.0.4.97.ga9feb21-1 |
None known |
lxcUbuntu:14.04:LTS |
All versions, plus listed versions 1.0.0~alpha1-0ubuntu111.0.0~alpha2-0ubuntu11.0.0~alpha2-0ubuntu31.0.0~alpha2-0ubuntu41.0.0~alpha2-0ubuntu5 Show 45 moreShow less1.0.0~alpha2-0ubuntu61.0.0~alpha3-0ubuntu11.0.0~alpha3-0ubuntu21.0.0~alpha3-0ubuntu31.0.0~alpha3-0ubuntu41.0.0~alpha3-0ubuntu51.0.0~alpha3-0ubuntu61.0.0~alpha3-0ubuntu71.0.0~alpha3-0ubuntu81.0.0~beta1-0ubuntu11.0.0~beta1-0ubuntu21.0.0~beta1-0ubuntu31.0.0~beta2-0ubuntu11.0.0~beta2-0ubuntu21.0.0~beta3-0ubuntu11.0.0~beta4-0ubuntu11.0.0~beta4-0ubuntu21.0.0~rc1-0ubuntu21.0.0~rc3-0ubuntu11.0.0~rc4-0ubuntu11.0.0-0ubuntu11.0.0-0ubuntu21.0.0-0ubuntu31.0.0-0ubuntu41.0.1-0ubuntu11.0.2-0ubuntu11.0.2-0ubuntu21.0.3-0ubuntu11.0.3-0ubuntu21.0.3-0ubuntu31.0.4-0ubuntu0.11.0.5-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.11.0.7-0ubuntu0.21.0.7-0ubuntu0.51.0.7-0ubuntu0.61.0.7-0ubuntu0.71.0.7-0ubuntu0.91.0.7-0ubuntu0.101.0.8-0ubuntu0.31.0.8-0ubuntu0.41.0.9-0ubuntu21.0.9-0ubuntu31.0.10-0ubuntu1 |
None known |
lxcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.1.4-0ubuntu11.1.4-0ubuntu1.11.1.4-0ubuntu31.1.5-0ubuntu11.1.5-0ubuntu2 Show 35 moreShow less1.1.5-0ubuntu31.1.5-0ubuntu41.1.5-0ubuntu51.1.5-0ubuntu62.0.0~beta2-0ubuntu22.0.0~rc1-0ubuntu12.0.0~rc2-0ubuntu22.0.0~rc3-0ubuntu12.0.0~rc3-0ubuntu22.0.0~rc3-0ubuntu32.0.0~rc4-0ubuntu12.0.0~rc5-0ubuntu12.0.0~rc9-0ubuntu12.0.0~rc10-0ubuntu12.0.0~rc10-0ubuntu22.0.0~rc11-0ubuntu12.0.0~rc12-0ubuntu12.0.0~rc13-0ubuntu22.0.0~rc14-0ubuntu22.0.0~rc15-0ubuntu12.0.0-0ubuntu12.0.0-0ubuntu22.0.1-0ubuntu1~16.04.12.0.3-0ubuntu1~ubuntu16.04.12.0.4-0ubuntu1~ubuntu16.04.22.0.5-0ubuntu1~ubuntu16.04.12.0.5-0ubuntu1~ubuntu16.04.22.0.5-0ubuntu1~ubuntu16.04.32.0.6-0ubuntu1~ubuntu16.04.12.0.6-0ubuntu1~ubuntu16.04.22.0.7-0ubuntu1~16.04.12.0.7-0ubuntu1~16.04.22.0.8-0ubuntu1~16.04.22.0.11-0ubuntu1~16.04.32.0.11-0ubuntu1~16.04.3+esm1 |
None known |
lxc-templatesUbuntu:18.04:LTS |
All versions, plus listed versions 3.0.0~beta1-0ubuntu13.0.0-0ubuntu1 |
None known |
lxc-templatesUbuntu:20.04:LTS |
All versions, plus listed versions 3.0.4-1ubuntu13.0.4-3ubuntu1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lxc-templatesUbuntu:22.04:LTS |
All versions, plus listed versions 3.0.4-5 |
None known |
lxc-templatesUbuntu:24.04:LTS |
All versions, plus listed versions 3.0.4.48.g4765da8-13.0.4.48.g4765da8-23.0.4.79.g84b0597-1 |
None known |
lxc-templatesUbuntu:25.10 |
All versions, plus listed versions 3.0.4.79.g84b0597-13.0.4.89.gc128b96-1 |
None known |
lxc-templatesUbuntu:26.10 |
All versions, plus listed versions 3.0.4.89.gc128b96-1build13.0.4.97.ga9feb21-13.0.4.97.ga9feb21-2 |
None known |
lxc-templatesUbuntu:26.04:LTS |
All versions, plus listed versions 3.0.4.89.gc128b96-13.0.4.89.gc128b96-1build1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.launchpad.net/ubuntu/+source/lxc/+bug/1661447
nvd.nist.gov/vuln/detail/CVE-2017-18641
github.com/advisories/GHSA-rv6g-hrqv-7f3p
security-tracker.debian.org/tracker/CVE-2017-18641
ubuntu.com/security/CVE-2017-18641
lists.debian.org/debian-lts/2020/02/msg00102.html
cve.org/CVERecord?id=CVE-2017-18641
Left out here: 1 version. The JSON record has them.