—
GO-2026-4882
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
Quick fix
GO-2026-4882 — github.com/lxc/incus/v6: upgrade to the fixed version with the command below.
go get github.com/lxc/incus/v6@v6.23.0Details
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/lxc/incus
Introduced in:
0No fixed version published yet for github.com/lxc/incus (go modules). Pin to a known-safe version or switch to an alternative.
References
- https://github.com/lxc/incus/security/advisories/GHSA-p8mm-23gg-jc9r[ADVISORY]
- https://github.com/lxc/incus/commit/04e97418189f743411884afb81a3384e6218b8cd[FIX]
- https://github.com/lxc/incus/commit/4a80447c52d6bc05d3322feeb5395f581e7a80e4[FIX]
- https://github.com/lxc/incus/commit/72688b7d9400c8f3c17ad0f93a7c1aeb89627307[FIX]
- https://github.com/lxc/incus/commit/ee26f72524ab60a4abcfd4e52667c52bb24364fc[FIX]
- https://github.com/lxc/incus/releases/tag/v6.23.0[WEB]