crítica
CVE-2026-48755
incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
GHSA10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA, Red Hat.
Descripción
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/lxc/incus/v7/cmd/incusd | 7.2.0 |
| alpine 3.24 | incus | 7.0.1-r0 |
| alpine edge | incus, incus-feature | 7.0.1-r0 y 1 más |
| debian 12 | lxd | sin corrección indicada |
| debian 13 | incus, lxd | 6.0.4-2+deb13u8 y 1 más |
| debian 14 | incus | 7.0.0-5 |
| echo | incus, lxd | 6.0.4-2+deb13u8 y 1 más |
| rapidfort alpine 3.20 | incus, incus-feature | 7.0.1-r0 y 1 más |
| rapidfort alpine 3.21 | incus, incus-feature | 7.0.1-r0 y 1 más |
| rapidfort alpine 3.22 | incus, incus-feature | 7.0.1-r0 y 1 más |
| rapidfort alpine 3.23 | incus, incus-feature | 7.0.1-r0 y 1 más |
| rapidfort alpine 3.24 | incus, incus-feature | 7.0.1-r0 y 1 más |
Mostrar las 32 entradas de 18 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/lxc/incus/v7/cmd/incusd | 7.2.0 |
| alpine 3.24 | incus | 7.0.1-r0 |
| alpine edge | incus | 7.0.1-r0 |
| alpine edge | incus-feature | 7.2.0-r0 |
| debian 12 | lxd | sin corrección indicada |
| debian 13 | incus | 6.0.4-2+deb13u8 |
| debian 13 | lxd | 5.0.2+git20231211.1364ae4-9+deb13u7 |
| debian 14 | incus | 7.0.0-5 |
| echo | incus | 6.0.4-2+deb13u8 |
| echo | lxd | 5.0.2+git20231211.1364ae4-9+deb13u7 |
| rapidfort alpine 3.20 | incus | 7.0.1-r0 |
| rapidfort alpine 3.20 | incus-feature | 7.2.0-r0 |
| rapidfort alpine 3.21 | incus | 7.0.1-r0 |
| rapidfort alpine 3.21 | incus-feature | 7.2.0-r0 |
| rapidfort alpine 3.22 | incus | 7.0.1-r0 |
| rapidfort alpine 3.22 | incus-feature | 7.2.0-r0 |
| rapidfort alpine 3.23 | incus | 7.0.1-r0 |
| rapidfort alpine 3.23 | incus-feature | 7.2.0-r0 |
| rapidfort alpine 3.24 | incus | 7.0.1-r0 |
| rapidfort alpine 3.24 | incus-feature | 7.2.0-r0 |
| rapidfort debian 12 | incus | 0:6.0.4-2+deb13u8, 0:7.0.0-5 |
| rapidfort debian 12 | lxd | 0:5.0.2+git20231211.1364ae4-9+deb13u7 |
| rapidfort debian 13 | incus | 0:6.0.4-2+deb13u8, 0:7.0.0-5 |
| rapidfort debian 13 | lxd | 0:5.0.2+git20231211.1364ae4-9+deb13u7 |
| rapidfort fedora 43 | incus | 6.23-4.fc43 |
| rapidfort fedora 43 | incus-agent | 6.23-4.fc43 |
| rapidfort fedora 43 | incus-client | 6.23-4.fc43 |
| rapidfort fedora 43 | incus-selinux | 6.23-4.fc43 |
| rapidfort fedora 43 | incus-tools | 6.23-4.fc43 |
| rapidfort ubuntu 20.04 | incus | 0:7.0.0-5 |
| rapidfort ubuntu 22.04 | incus | 0:7.0.0-5 |
| rapidfort ubuntu 24.04 | incus | 0:7.0.0-5 |