Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-33542US | medium4.8 | — | ||
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers op… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/lxc/incus/commit/04e97418189f743411884afb81a3384e6218b8cdFIX
- https://github.com/lxc/incus/commit/4a80447c52d6bc05d3322feeb5395f581e7a80e4FIX
- https://github.com/lxc/incus/commit/72688b7d9400c8f3c17ad0f93a7c1aeb89627307FIX
- https://github.com/lxc/incus/commit/ee26f72524ab60a4abcfd4e52667c52bb24364fcFIX
- https://github.com/lxc/incus/releases/tag/v6.23.0WEB
- https://github.com/lxc/incus/security/advisories/GHSA-p8mm-23gg-jc9rADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan