Missing validation of network configuration fields
Betroffene Pakete
libpve-common-perl, pve-manager
Details
Some fields/options in the network configuration /etc/network/interfaces which are exposed over the network configuration API were lacking validation, allowing the injection of arbitrary lines in the generated configuration file.
Since some network configuration options allow executing arbitrary commands as root during boot or network settings reload tasks, this effectively is a root privilege escalation which can be triggered by users/tokens with Sys.Modify privileges on /nodes/{node}.
This issue was found internally.
Behoben in
- pve-manager >= 9.2.23
Diese Seite ist eine inoffizielle Kopie des offiziellen Beitrags im Proxmox-Forum (öffnet in neuem Tab). Prüfe vor jeder Maßnahme das Original. Der Text des Advisories wird so auf Englisch angezeigt, wie Proxmox ihn veröffentlicht hat.