OCI extraction path escape
Affected packages
pve-container, librust-proxmox-oci-dev/libpve-rs-perl
Details
Missing checks when applying whiteouts during OCI template extraction allowed an attacker to use malformed images to delete arbitrary files and directories outside of the target rootfs.
This issue was reported privately by Project Loupe, and later also reported by Apo - CSB Raccoon Labs <[email protected]>.
Fixed in
- librust-proxmox-oci-dev >= 0.2.2
- libpve-rs-perl >= 0.15.4
This page reproduces the official Proxmox forum post (opens in a new tab). The original is authoritative.