{"id":"CVE-2017-18641","details":"In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.","modified":"2026-07-08T15:11:01.595517Z","published":"2020-02-10T01:15:10.483Z","references":[{"type":"FIX","url":"https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1661447"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lxc/lxc","events":[{"introduced":"823765e50bf4df2f2365bd2590768676634919b7"},{"last_affected":"823765e50bf4df2f2365bd2590768676634919b7"}],"database_specific":{"cpe":"cpe:2.3:a:linuxcontainers:lxc:2.0.0:-:*:*:*:*:*:*","extracted_events":[{"introduced":"2.0.0-NA"},{"last_affected":"2.0.0-NA"}],"source":"CPE_STRING"}}],"versions":["2.0.0-NA","lxc-2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-18641.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}