incomplete privilege checks for unused volumes
Affected packages
qemu-server, pve-container
Details
Incomplete privilege checks when adding an unused volume to a guest allowed accessing volumes that were out of scope for the user/API token adding the volume.
This issue was reported privately by Geoffrey McClinsey <[email protected]> for qemu-server, a related issue in pve-container was found while developing the fix.
Fixed in
- qemu-server >= 9.2.2 (PVE 9.x)
- pve-container >= 6.1.13 (PVE 9.x)
- qemu-server >= 8.4.9 (PVE 8.x)
- pve-container >= 5.3.6 (PVE 8.x)
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.