Incus does not verify combined fingerprint when downloading images from simplestreams servers
概要
Incus does not verify combined fingerprint when downloading images from simplestreams servers
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2026-33542 incus 修正版: 6.0.4-2+deb13u5
- Ubuntu UBUNTU-CVE-2026-33542 lxd
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov