--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
User: [email protected]
Usertags: pu
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:incus
[ Reason ]
Last week's release of Incus 7.4 included fixes for two moderate
severity issues, CVE-2026-81500 and CVE-2026-81501. After discussion
with the Security Team, these vulnerabilities won't receive their own
DSA, but will be addressed via the upcoming point release.
[ Impact ]
Incus in trixie is currently vulnerable to CVE-2026-81500 and CVE-2026-
81501.
[ Tests ]
None -- both security issues are somewhat obscure edge cases, but the
fixes have been in the stable release for a week now and no regressions
have been reported upstream.
[ Risks ]
Minor/none -- two targeted fixes cherry-picked from the upstream git
repo.
[ Checklist ]
[*] *all* changes are documented in the d/changelog
[*] I reviewed all changes and I approve them
[*] attach debdiff against the package in (old)stable
[*] the issue is verified as fixed in unstable
[ Changes ]
Two security fixes as outlined above. Also updated d/changelog with
missing CVEs that hadn't been assigned by GitHub when the previous
release was uploaded.
[ Other info ]
The source debdiff is attached.
diff --git a/debian/changelog b/debian/changelog
index 438c618e46..8cc80a7c1f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+incus (6.0.4-2+deb13u10) trixie; urgency=medium
+
+ * Cherry-pick fixes for the following security issues
+ - CVE-2026-81500 / GHSA-9pqw-c7m4-xvg7
+ - CVE-2026-81501 / GHSA-c6wx-8679-hpr9
+
+ -- Mathias Gibbens <[email protected]> Wed, 02 Sep 2026 16:39:29 +0000
+
incus (6.0.4-2+deb13u9) trixie-security; urgency=high
* Cherry-pick upstream fix for large nft ruleset performance
@@ -8,11 +16,11 @@ incus (6.0.4-2+deb13u9) trixie-security; urgency=high
- CVE-2026-62941 / GHSA-mq9x-prm8-3vpw
- CVE-2026-63125 / GHSA-6rqx-22hc-qm36
- CVE-2026-63343 / GHSA-fmjx-5j3g-997p
- - GHSA-26gp-p5fw-3r2h
- - GHSA-4qxq-p5hm-3q3p
- - GHSA-67qw-68v3-36h6
- - GHSA-m3j6-p3v3-qmjv
- - GHSA-p2v3-6wvc-cv3p
+ - CVE-2026-81493 / GHSA-p2v3-6wvc-cv3p
+ - CVE-2026-81495 / GHSA-67qw-68v3-36h6
+ - CVE-2026-81496 / GHSA-26gp-p5fw-3r2h
+ - CVE-2026-81497 / GHSA-4qxq-p5hm-3q3p
+ - CVE-2026-81498 / GHSA-m3j6-p3v3-qmjv
* Cherry-pick four additional security fixes not assigned CVEs
-- Mathias Gibbens <[email protected]> Thu, 30 Jul 2026 22:57:51 +0000
diff --git a/debian/patches/147-CVE-2026-81500.patch b/debian/patches/147-CVE-2026-81500.patch
new file mode 100644
index 0000000000..217f0de519
--- /dev/null
+++ b/debian/patches/147-CVE-2026-81500.patch
@@ -0,0 +1,91 @@
+From d4d7badf6597274320b78575e77aec5720163c9c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?St=C3=A9phane=20Graber?= <[email protected]>
+Date: Sun, 23 Aug 2026 17:26:26 -0400
+Subject: [PATCH] client/images: Prevent path traversal in downloaded image
+ name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The local filename for an exported image came from server-controlled
+data (Content-Disposition for unified images, the simplestreams index
+path) and was joined with the target directory. Basename it.
+
+This addresses GHSA-9pqw-c7m4-xvg7 (CVE pending)
+
+Signed-off-by: Stéphane Graber <[email protected]>
+Rebased-by: Mathias Gibbens <[email protected]>
+---
+ client/incus_images.go | 4 +++-
+ client/simplestreams_images.go | 13 +++++++------
+ 2 files changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/client/incus_images.go b/client/incus_images.go
+index ed48d08be..3a0afccb2 100644
+--- a/client/incus_images.go
++++ b/client/incus_images.go
+@@ -9,6 +9,7 @@ import (
+ "net/http"
+ "net/url"
+ "os"
++ "path/filepath"
+ "slices"
+ "strings"
+ "time"
+@@ -325,7 +326,8 @@ func incusDownloadImage(fingerprint string, uri string, userAgent string, do fun
+ }
+
+ resp.MetaSize = size
+- resp.MetaName = filename
++ // Basename the server-provided name to prevent path traversal.
++ resp.MetaName = filepath.Base(filename)
+
+ // Check the hash
+ hash := fmt.Sprintf("%x", sha256.Sum(nil))
+diff --git a/client/simplestreams_images.go b/client/simplestreams_images.go
+index 00cc35409..6bbfbe9d4 100644
+--- a/client/simplestreams_images.go
++++ b/client/simplestreams_images.go
+@@ -10,6 +10,7 @@ import (
+ "net/url"
+ "os"
+ "os/exec"
++ "path/filepath"
+ "strings"
+ "time"
+
+@@ -143,8 +144,8 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
+ return nil, err
+ }
+
+- parts := strings.Split(meta.Path, "/")
+- resp.MetaName = parts[len(parts)-1]
++ // Basename the server-provided name to prevent path traversal.
++ resp.MetaName = filepath.Base(meta.Path)
+ resp.MetaSize = size
+ }
+
+@@ -205,8 +206,8 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
+ return nil, err
+ }
+
+- parts := strings.Split(rootfs.Path, "/")
+- resp.RootfsName = parts[len(parts)-1]
++ // Basename the server-provided name to prevent path traversal.
++ resp.RootfsName = filepath.Base(rootfs.Path)
+ resp.RootfsSize = size
+ downloaded = true
+ }
+@@ -219,8 +220,8 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
+ return nil, err
+ }
+
+- parts := strings.Split(rootfs.Path, "/")
+- resp.RootfsName = parts[len(parts)-1]
++ // Basename the server-provided name to prevent path traversal.
++ resp.RootfsName = filepath.Base(rootfs.Path)
+ resp.RootfsSize = size
+ }
+ }
+--
+2.47.3
diff --git a/debian/patches/148-CVE-2026-81501.patch b/debian/patches/148-CVE-2026-81501.patch
new file mode 100644
index 0000000000..f05a56fb8b
--- /dev/null
+++ b/debian/patches/148-CVE-2026-81501.patch
@@ -0,0 +1,115 @@
+From a04abf23169d0597a544c6d96044a0f7aa9f19bf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?St=C3=A9phane=20Graber?= <[email protected]>
+Date: Sun, 23 Aug 2026 17:26:26 -0400
+Subject: [PATCH] incusd/images: Check access before reusing cross-project
+ image
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+imageDownload reused an image from another project without checking the
+caller could view it, letting a client that knew a private fingerprint
+import it. Only reuse it directly when public or viewable, otherwise
+download it (proving access) and dedupe against the on-disk copy.
+
+This addresses GHSA-c6wx-8679-hpr9 (CVE pending)
+
+Signed-off-by: Stéphane Graber <[email protected]>
+Rebased-by: Mathias Gibbens <[email protected]>
+---
+ cmd/incusd/daemon_images.go | 38 +++++++++++++++++++++++++++++++-----
+ internal/server/db/images.go | 1 +
+ 2 files changed, 34 insertions(+), 5 deletions(-)
+
+diff --git a/cmd/incusd/daemon_images.go b/cmd/incusd/daemon_images.go
+index 8eafb6de4..c26e1540e 100644
+--- a/cmd/incusd/daemon_images.go
++++ b/cmd/incusd/daemon_images.go
+@@ -14,6 +14,7 @@ import (
+
+ incus "github.com/lxc/incus/v6/client"
+ internalIO "github.com/lxc/incus/v6/internal/io"
++ "github.com/lxc/incus/v6/internal/server/auth"
+ "github.com/lxc/incus/v6/internal/server/db"
+ "github.com/lxc/incus/v6/internal/server/db/cluster"
+ "github.com/lxc/incus/v6/internal/server/locking"
+@@ -195,13 +196,37 @@ func ImageDownload(ctx context.Context, r *http.Request, s *state.State, op *ope
+ }
+ }
+ } else if response.IsNotFoundError(err) {
++ var otherImg *api.Image
+ err = s.DB.Cluster.Transaction(ctx, func(ctx context.Context, tx *db.ClusterTx) error {
+ // Check if the image already exists in some other project.
+- _, imgInfo, err = tx.GetImageFromAnyProject(ctx, fp)
++ _, otherImg, err = tx.GetImageFromAnyProject(ctx, fp)
+
+ return err
+ })
+ if err == nil {
++ // Only reuse another project's image when the caller may see it,
++ // otherwise download it (proving access) and dedupe on disk.
++ reuse := otherImg.Public || r == nil
++ if !reuse {
++ err = s.Authorizer.CheckPermission(ctx, r, auth.ObjectImage(otherImg.Project, otherImg.Fingerprint), auth.EntitlementCanView)
++ if err == nil {
++ reuse = true
++ } else if !api.StatusErrorCheck(err, http.StatusForbidden) {
++ return nil, false, err
++ }
++
++ err = nil
++ }
++
++ if reuse {
++ imgInfo = otherImg
++ } else if args.Server == "" {
++ // No source to prove access against.
++ return nil, false, api.StatusErrorf(http.StatusNotFound, "Image not found")
++ }
++ }
++
++ if err == nil && imgInfo != nil {
+ var nodeAddress string
+
+ err = s.DB.Cluster.Transaction(ctx, func(ctx context.Context, tx *db.ClusterTx) error {
+@@ -317,9 +342,9 @@ func ImageDownload(ctx context.Context, r *http.Request, s *state.State, op *ope
+ return nil, false, fmt.Errorf("Invalid image fingerprint")
+ }
+
+- // Cleanup any leftover from a past attempt
++ // Download to a temporary name so an existing on-disk copy isn't overwritten.
+ destDir := internalUtil.VarPath("images")
+- destName := filepath.Join(destDir, fp)
++ destName := filepath.Join(destDir, fp+".download")
+
+ failure := true
+ cleanup := func() {
+@@ -576,9 +601,12 @@ func ImageDownload(ctx context.Context, r *http.Request, s *state.State, op *ope
+ return nil, false, fmt.Errorf("Invalid image fingerprint")
+ }
+
+- // Check if the image path changed (private images)
++ // Reuse an existing on-disk copy if present, otherwise move ours into place.
+ newDestName := filepath.Join(destDir, fp)
+- if newDestName != destName {
++ if util.PathExists(newDestName) {
++ _ = os.Remove(destName)
++ _ = os.Remove(destName + ".rootfs")
++ } else {
+ err = internalUtil.FileMove(destName, newDestName)
+ if err != nil {
+ return nil, false, err
+diff --git a/internal/server/db/images.go b/internal/server/db/images.go
+index 2a730e596..b3719becf 100644
+--- a/internal/server/db/images.go
++++ b/internal/server/db/images.go
+@@ -436,6 +436,7 @@ func (c *ClusterTx) GetImageFromAnyProject(ctx context.Context, fingerprint stri
+
+ object = images[0]
+
++ image.Project = object.Project
+ image.Fingerprint = object.Fingerprint
+ image.Filename = object.Filename
+ image.Size = object.Size
+--
+2.47.3
diff --git a/debian/patches/series b/debian/patches/series
index 45d2cab03b..f04af2fc4f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -54,3 +54,5 @@
144-GHSA-m3j6-p3v3-qmjv.patch
145-GHSA-p2v3-6wvc-cv3p.patch
146-incus-7.3-fixes.patch
+147-CVE-2026-81500.patch
+148-CVE-2026-81501.patch
signature.asc
Description: This is a digitally signed message part
--- End Message ---
