incus-mirror/internal/instance
Stéphane Graber cdf037409f
internal/instance: Prevent line breaks in environment variables
LXC doesn't currently have a syntax to hold a multi-line environment
variable in its configuration. The use of multi-line environment
variables leads to a corrupted configuration file and to a security
issue where additional lines may be added by an unprivileged user to
escalate their privileges.

This fixes CVE-2026-23953.

Reported-by: Rory McNamara <rory.mcnamara@snyk.io>
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-01-20 23:27:27 -05:00
..
action.go internal/instance: New package from shared/instance.go 2023-09-26 15:58:59 -04:00
config.go internal/instance: Prevent line breaks in environment variables 2026-01-20 23:27:27 -05:00
device.go internal/instance: Introduce SplitVolumeSource 2025-07-11 21:13:18 -04:00
expiry.go internal/instance: Add exported error 2025-06-19 14:04:39 -04:00
snapshot.go incus/instance: Add missing godocs 2025-11-10 13:59:10 +01:00