[Git][security-tracker-team/security-tracker][master] More Incus issues CVEified

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b6dc6d3c by Salvatore Bonaccorso at 2026-10-23T09:41:09+02:00
More Incus issues CVEified

- - - - -


2 changed files:

- data/CVE/list
- data/DSA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -362,14 +362,6 @@ CVE-2026-115380 (Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 befor
 	TODO: check
 CVE-2026-115379 (Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a miss ...)
 	TODO: check
-CVE-2026-115373 (Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contain ...)
-	TODO: check
-CVE-2026-115372 (Incus from 7.3.0 before 7.5.0 contains a project restriction bypass th ...)
-	TODO: check
-CVE-2026-115371 (Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 c ...)
-	TODO: check
-CVE-2026-115370 (Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0  ...)
-	TODO: check
 CVE-2026-115369 (OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ ...)
 	- openbao <itp> (bug #1069794)
 CVE-2026-115366 (OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vul ...)
@@ -42074,9 +42066,8 @@ CVE-2026-97230 (IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains
 	NOT-FOR-US: IO::Socket::SSL::SelfCertificate Perl module
 CVE-2026-85491 (Catalyst::Seal versions before 0.03 for Perl allow one request to disa ...)
 	NOT-FOR-US: Catalyst::Seal Perl module
-CVE-2026-XXXX [GHSA-4cph-ccqv-hm3c]
+CVE-2026-115372 [GHSA-4cph-ccqv-hm3c]
 	- incus 7.0.1-5
-	[trixie] - incus 6.0.4-2+deb13u11
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-4cph-ccqv-hm3c
 CVE-2026-115375 [GHSA-hpjh-q53p-f27r]
 	- incus 7.0.1-5
@@ -42085,9 +42076,8 @@ CVE-2026-115375 [GHSA-hpjh-q53p-f27r]
 CVE-2026-115377 [GHSA-579w-c4rw-c8q3]
 	- incus 7.0.1-5
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3
-CVE-2026-XXXX [GHSA-x8gj-2q73-qr6j]
+CVE-2026-115371 [GHSA-x8gj-2q73-qr6j]
 	- incus 7.0.1-5
-	[trixie] - incus 6.0.4-2+deb13u11
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j
 CVE-2026-115374 [GHSA-mmj7-8rgf-mx2h]
 	- incus 7.0.1-5
@@ -42096,15 +42086,14 @@ CVE-2026-115374 [GHSA-mmj7-8rgf-mx2h]
 CVE-2026-115376 [GHSA-jh4v-j34r-2mgh]
 	- incus 7.0.1-5
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-jh4v-j34r-2mgh
-CVE-2026-XXXX [GHSA-mfwv-x733-9446]
+CVE-2026-115373 [GHSA-mfwv-x733-9446]
 	- incus 7.0.1-5
-	[trixie] - incus 6.0.4-2+deb13u11
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-mfwv-x733-9446
 CVE-2026-115378 [GHSA-wfvq-qh87-gm4j]
 	- incus 7.0.1-5
 	[trixie] - incus <postponed> (Wait until 6.x backport is available)
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-wfvq-qh87-gm4j
-CVE-2026-XXXX [GHSA-443p-7392-h4v2]
+CVE-2026-115370 [GHSA-443p-7392-h4v2]
 	- incus 7.0.1-5
 	[trixie] - incus <not-affected> (Vulnerable code not present, only affects 7.x)
 	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-443p-7392-h4v2


=====================================
data/DSA/list
=====================================
@@ -181,7 +181,7 @@
 	{CVE-2026-97149}
 	[trixie] - swift 2.35.1-0+deb13u4
 [26 Sep 2026] DSA-6518-1 incus - security update
-	{CVE-2026-115376 CVE-2026-115377}
+	{CVE-2026-115371 CVE-2026-115372 CVE-2026-115373 CVE-2026-115376 CVE-2026-115377}
 	[trixie] - incus 6.0.4-2+deb13u11
 [26 Sep 2026] DSA-6517-1 nodejs - security update
 	{CVE-2026-48617 CVE-2026-48618 CVE-2026-48619 CVE-2026-48928 CVE-2026-48930 CVE-2026-48931 CVE-2026-48933 CVE-2026-48934 CVE-2026-48935 CVE-2026-48937 CVE-2026-56846 CVE-2026-56847 CVE-2026-56848 CVE-2026-56850 CVE-2026-58039 CVE-2026-58042 CVE-2026-58043}



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6dc6d3c74503007c0d9e73f188e1cdc42d3866e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6dc6d3c74503007c0d9e73f188e1cdc42d3866e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/acd6b687/attachment.htm>