Terug naar het wijzigingslogboek
VPS Manager (Incus)
v6.0.7
Incus 6.0.7 LTS security release: tenant and project boundary enforcement, authorization fail-closed, pre-authentication exposure, symlink and path-traversal fixes.
Verbeteringen
2- Applying this package does not restart the Incus service, so running isolated environments are not interrupted; the new binaries take effect at the next service restart or reboot.
- The 6.0 LTS line is kept on purpose: Incus 7.0 and later require kernel 6.12 or newer, while several supported systems ship older kernels. Incus 6.0 LTS is supported until June 2029.
Bugfixes
7- Project restrictions are now enforced on snapshot restore, migration overrides and clustered refresh, and re-checked after a copy merges its configuration.
- Copying an instance or a storage volume now checks access to the source, and a cross-project image is no longer reused without an access check.
- Reading or waiting on an operation now checks project access; access-token operations are hidden from non-admins; reading a storage bucket's keys requires edit permission.
- Unknown authorization project expansion now fails closed instead of open.
- The API extension list is no longer exposed before authentication, the websocket origin-check bypass is removed, and a certificate's type can no longer be changed.
- Console, rootfs and exec-output symlinks are rejected, migration data is not followed through symlinks, and template, metadata and credential access is confined to the instance root.
- Secrets are compared in constant time; request bodies, websocket control messages and tarball metadata reads are bounded; three nil-pointer crashes are fixed.