Incus does not verify combined fingerprint when downloading images from simplestreams servers
Résumé
Incus does not verify combined fingerprint when downloading images from simplestreams servers
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-33542 incus Corrigé dans: 6.0.4-2+deb13u5
- Ubuntu UBUNTU-CVE-2026-33542 lxd
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov