{"id":"UBUNTU-CVE-2024-6107","details":"Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.","modified":"2025-10-24T05:06:45Z","published":"2025-07-23T00:00:00Z","upstream":["CVE-2024-6107"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-6107"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2024-6107"}],"affected":[{"package":{"name":"maas","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/maas@2.3.5-6511-gf466fdb-0ubuntu1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3+bzr4053-0ubuntu1","1.9.0+bzr4533-0ubuntu1","1.10.0+bzr4578-0ubuntu2","2.0.0~alpha1+bzr4736-0ubuntu1","2.0.0~alpha2+bzr4776-0ubuntu1","2.0.0~alpha3+bzr4810-0ubuntu1","2.0.0~alpha4+bzr4843-0ubuntu1","2.0.0~beta1+bzr4873-0ubuntu1","2.0.0~beta1+bzr4873-0ubuntu2","2.0.0~beta1+bzr4873-0ubuntu3","2.0.0~beta2+bzr4920-0ubuntu1","2.0.0~beta2+bzr4920-0ubuntu2","2.0.0~beta3+bzr4941-0ubuntu1","2.0.0~rc2+bzr5156-0ubuntu1~16.04.1","2.0.0~rc2+bzr5156-0ubuntu1~16.04.2","2.0.0+bzr5189-0ubuntu1~16.04.1","2.1.1+bzr5544-0ubuntu1~16.04.1","2.1.3+bzr5573-0ubuntu1~16.04.1","2.1.5+bzr5596-0ubuntu1~16.04.1","2.2.0+bzr6054-0ubuntu2~16.04.1","2.2.2-6099-g8751f91-0ubuntu1~16.04.1","2.3.0-6434-gd354690-0ubuntu1~16.04.1","2.3.5-6511-gf466fdb-0ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"maas","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_name":"maas-cli","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_name":"maas-common","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_name":"maas-dhcp","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_name":"maas-dns","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_version":"2.3.5-6511-gf466fdb-0ubuntu1","binary_name":"maas-proxy"},{"binary_name":"maas-rack-controller","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_name":"maas-region-api","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_name":"maas-region-controller","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_name":"python3-django-maas","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_name":"python3-maas-client","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"},{"binary_name":"python3-maas-provisioningserver","binary_version":"2.3.5-6511-gf466fdb-0ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6107.json"}},{"package":{"name":"maas","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/maas@2.4.2-7034-g2f5deb8b8-0ubuntu1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0~beta2-6327-gdd05aa2-0ubuntu1","2.3.0-6434-gd354690-0ubuntu1","2.4.0~alpha2-6717-gffaddd526-0ubuntu1~18.04.1","2.4.0~beta1-6799-g391e5f16d-0ubuntu1","2.4.0~beta2-6865-gec43e47e6-0ubuntu1","2.4.0-6981-g011e51b7a-0ubuntu1~18.04.1","2.4.2-7034-g2f5deb8b8-0ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"maas","binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1"},{"binary_name":"maas-cli","binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1"},{"binary_name":"maas-common","binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1"},{"binary_name":"maas-dhcp","binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1"},{"binary_name":"maas-dns","binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1"},{"binary_name":"maas-proxy","binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1"},{"binary_name":"maas-rack-controller","binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1"},{"binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1","binary_name":"maas-region-api"},{"binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1","binary_name":"maas-region-controller"},{"binary_name":"python3-django-maas","binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1"},{"binary_name":"python3-maas-client","binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1"},{"binary_version":"2.4.2-7034-g2f5deb8b8-0ubuntu1","binary_name":"python3-maas-provisioningserver"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6107.json"}},{"package":{"name":"maas","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/maas@1:0.7?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-7802-g59416a869-0ubuntu1","1:0.1","1:0.2","1:0.3","1:0.4","1:0.5","1:0.6","1:0.7"],"ecosystem_specific":{"binaries":[{"binary_name":"maas","binary_version":"1:0.7"},{"binary_name":"maas-rack-controller","binary_version":"1:0.7"},{"binary_name":"maas-region-api","binary_version":"1:0.7"},{"binary_name":"maas-region-controller","binary_version":"1:0.7"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6107.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}