Anbox Management Service vulnerability affects TLS certificate validation

CVE-2024-8287

Summary

The Anbox Management Service, encompassing versions 1.17.0 through 1.23.0, suffers from a vulnerability where it fails to adequately validate the TLS certificate from the Anbox Stream Agent. This oversight can facilitate a scenario where an attacker, having access to the internal network, could perform a machine-in-the-middle attack. Such a compromise allows malicious entities to intercept potentially sensitive data exchanged between the service and the agent, thereby posing significant risks to system security. Organizations using affected versions must review their network security measures and implement patches or mitigation strategies to safeguard against unauthorized access.

References