FRR config injection issues

Details

An inconsistency between the Perl and Rust implementations handling property strings, and a lax API schema for the route maps config option, allowed an attacker with privileges to add route maps to inject arbitrary lines into the generated FRR configuration.

An incomplete schema for the isis-domain option for the Isis controller allowed an attacker with privileges to set it to use an invalid value, resulting in an invalid FRR config and problems applying the SDN configuration.

These issues were reported privately by Apo - CSB Raccoon <[email protected]>.

Fixed in

• libpve-network-perl >= 1.6.8, libpve-network-api-perl >= 1.6.8

• libpve-rs-perl >= 0.15.4