Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named exec_UUID.stdout and exec_UUID.stderr can be written to an arbitrary location where the .stdout file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 go | | | 7.2.0 |
go | | - | - |
go | | - | - |
go | | | 7.2.0 |
 debian 13 | | =6.0.4-2 || =6.0.4-2+deb13u1 || =6.0.4-2+deb13u1~bpo12+1 || =6.0.4-2+deb13u2 || =6.0.4-2+deb13u2~bpo12+1 || =6.0.4-2+deb13u3 || =6.0.4-2+deb13u3~bpo12+1 || =6.0.4-2+deb13u4 || =6.0.4-2+deb13u4~bpo12+1 || =6.0.4-2+deb13u5 || =6.0.4-2+deb13u5~bpo12+1 || =6.0.4-2+deb13u6 || =6.0.4-2+deb13u6~bpo12+1 || =6.0.4-2+deb13u7 || =6.0.4-2+deb13u7~bpo12+1 || >=0 <6.0.4-2+deb13u8 | 6.0.4-2+deb13u8 |
debian 14 | | =6.0.4-2 || =6.0.4-3 || =6.0.5-1 || =6.0.5-2 || =6.0.5-3 || =6.0.5-4 || =6.0.5-5 || =6.0.5-6 || =6.0.5-7 || =6.0.5-8 || =6.0.6-1 || =6.0.6-2 || =6.0.6-3 || =6.14.0-1~exp1 || =6.15.0-1~exp1 || =6.16.0-1~exp1 || =6.17.0-1~exp1 || =6.20.0-1~exp1 || =6.21.0-1~exp1 || =6.22.0-1~exp1 || =6.23.0-1~exp1 || =7.0.0-1 || =7.0.0-1~bpo13+1 || =7.0.0-2 || =7.0.0-2~bpo13+1 || =7.0.0-3 || =7.0.0-4 || =7.0.0-5~bpo13+1 || >=0 <7.0.0-5 | 7.0.0-5 |
debian 12 | | =5.0.2+git20231211.1364ae4-1 || =5.0.2+git20231211.1364ae4-2 || =5.0.2+git20231211.1364ae4-3 || =5.0.2+git20231211.1364ae4-4 || =5.0.2+git20231211.1364ae4-5 || =5.0.2+git20231211.1364ae4-6 || =5.0.2+git20231211.1364ae4-7 || =5.0.2+git20231211.1364ae4-8 || =5.0.2+git20231211.1364ae4-9 || =5.0.2-5 || =5.0.2-5+deb12u1 || =5.0.2-5+deb12u2 || =5.0.2-5+deb12u3 || =5.0.2-5+deb12u4 || =5.0.2-5+deb12u5 || =5.0.2-5+deb12u6 || =5.0.2-6 | - |
debian 13 | | =5.0.2+git20231211.1364ae4-9 || =5.0.2+git20231211.1364ae4-9+deb13u1 || =5.0.2+git20231211.1364ae4-9+deb13u2 || =5.0.2+git20231211.1364ae4-9+deb13u3 || =5.0.2+git20231211.1364ae4-9+deb13u4 || =5.0.2+git20231211.1364ae4-9+deb13u5 || =5.0.2+git20231211.1364ae4-9+deb13u6 || >=0 <5.0.2+git20231211.1364ae4-9+deb13u7 | 5.0.2+git20231211.1364ae4-9+deb13u7 |
 alpine v3.24 | | | 7.0.1-r0 |
