Description
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 14 | | =6.0.4-2 || =6.0.4-3 || =6.0.5-1 || =6.0.5-2 || =6.0.5-3 || =6.0.5-4 || =6.0.5-5 || =6.0.5-6 || =6.0.5-7 || =6.0.5-8 || =6.0.6-1 || =6.0.6-2 || =6.0.6-3 || =6.14.0-1~exp1 || =6.15.0-1~exp1 || =6.16.0-1~exp1 || =6.17.0-1~exp1 || =6.20.0-1~exp1 || =6.21.0-1~exp1 || =6.22.0-1~exp1 || =6.23.0-1~exp1 || =7.0.0-1 || =7.0.0-1~bpo13+1 || =7.0.0-2 || =7.0.0-2~bpo13+1 || =7.0.0-3 || =7.0.0-4 || =7.0.0-5 || =7.0.0-5~bpo13+1 || =7.0.1-1 || =7.0.1-1~bpo13+1 || =7.0.1-2 || =7.0.1-2~bpo13+1 || =7.0.1-3 || =7.0.1-3~bpo13+1 || =7.0.1-4 || =7.0.1-5~bpo13+1 || >=0 <7.0.1-5 | 7.0.1-5 |
debian 13 | | =6.0.4-2 || =6.0.4-2+deb13u1 || =6.0.4-2+deb13u10 || =6.0.4-2+deb13u1~bpo12+1 || =6.0.4-2+deb13u2 || =6.0.4-2+deb13u2~bpo12+1 || =6.0.4-2+deb13u3 || =6.0.4-2+deb13u3~bpo12+1 || =6.0.4-2+deb13u4 || =6.0.4-2+deb13u4~bpo12+1 || =6.0.4-2+deb13u5 || =6.0.4-2+deb13u5~bpo12+1 || =6.0.4-2+deb13u6 || =6.0.4-2+deb13u6~bpo12+1 || =6.0.4-2+deb13u7 || =6.0.4-2+deb13u7~bpo12+1 || =6.0.4-2+deb13u8 || =6.0.4-2+deb13u9 || >=0 <6.0.4-2+deb13u11 | 6.0.4-2+deb13u11 |
