CVE-2024-8287

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-18 · updated 2026-06-17
Weakness: CWE-295

Description

Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this.

Affected products

Canonical Ltd. Anbox Cloud: from 1.17.0 before 1.23.1 — fixed in 1.23.1

How to fix

Upgrade to a fixed version: Canonical Ltd. Anbox Cloud 1.23.1. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/anbox-cloud/+bug/2077570
https://discourse.ubuntu.com/t/anbox-cloud-1-23-1-has-been-released/48141
https://www.cve.org/CVERecord?id=CVE-2024-8287

Get alerted when CVE-2024-8287 or the next vulnerability affects your stack