Missing protections against malicious backup clients with S3-backed datastores

Details

On datastores configured with an S3 backend, a malicious client could upload chunks with invalid metadata, including a digest that does not match the uploaded content.

This could be exploited to leak contents of unencrypted chunks in other backups, or ensure re-use of corrupt chunks created by such an attack until the next verification task has run.

Note: Both exploits require either guessing the required chunk digest by brute force, or obtaining it via other means.

This issue was discovered and fixed internally.

Fixed in

proxmox-backup-server >= 4.0.18-1