missing parameter validation in remote migration
Affected packages
qemu-server
Details
Missing parameter validation in Proxmox VE's remote migration code allowed an attacker with Sys.Incoming privileges to inject arbitrary values in parts of the QEMU command line on the migration target.
This issue was privately reported by Geoffrey McClinsey <[email protected]>.
Fixed in
- qemu-server >= 9.2.3 (PVE 9.x)
- qemu-server >= 8.4.9 (PVE 8.x)
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.