newline injection into firewall config files
Affected packages
pve-firewall, proxmox-firewall
Details
Incomplete validation of API parameters allowed the injection of newlines or invalid lines into firewall configuration files.
The original issue was reported privately by Geoffrey McClinsey <[email protected]>. Further related issues were found and fixed while developing the fix.
Fixed in
- pve-firewall >= 6.0.6
- libpve-common-perl >= 9.2.2
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.