Proxmox Backup Server: unauthenticated DOS vulnerability
Affected packages
proxmox-backup-server (== 3.2.8-1, pbstest and pbs-no-subscription only)
Details
Proxmox Backup Server in version 3.2.8-1 was vulnerable to a remote unauthenticated DOS attack.
By opening a connection to the API server on port 8007 and closing the connection within the first ten seconds while sending less than 5 bytes, the thread handling this connection would consume 100% CPU time until a restart of the proxmox-backup-proxy service.
Fixed in
- proxmox-backup-server: 3.2.9-1
References
https://bugzilla.proxmox.com/show_bug.cgi?id=5868 (opens in a new tab)
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.