PMG: Bypass of mail filters by crafted boundary parameters
Betroffene Pakete
pmg-api, libmime-tools-perl
Details
Certain problematic strings used as Content-Type boundaries were not covered by the fixes for PSA-2026-00005-1. With a fitting boundary the parser could be tricked into treating a malicious attachment as epilogue to a multipart message and skipping the checks on the part.
Some mail user agents display such parts hidden in the epilogue as attachments, potentially exposing users to unwanted and dangerous content.
This issue was privately reported by Artem Danilov of Positive Technologies.
Behoben in
- libmime-tools-perl >= 5.515-1+pmg2
Referenzen
- PSA-2026-00005-1 was about a similar issue.
Diese Seite ist eine inoffizielle Kopie des offiziellen Beitrags im Proxmox-Forum (öffnet in neuem Tab). Prüfe vor jeder Maßnahme das Original. Der Text des Advisories wird so auf Englisch angezeigt, wie Proxmox ihn veröffentlicht hat.