Proxmox/ProxmoxVE
1
0
Fork 1
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-07-13 17:35:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

security: Fix HTTP to HTTPS for all package and repository downloads

Browse Source 
CRITICAL FIXES (CWE-494, CWE-300):
- tools/pve/microcode.sh:79 (Intel microcode)
- tools/pve/pbs-microcode.sh:93 (Intel microcode)

CONTAINER-LEVEL FIXES:
- install/deconz-install.sh: libssl1.1 .deb + setup_deb822_repo URLs
- install/odoo-install.sh: lxml-clean .deb
- ct/odoo.sh: lxml-clean .deb (update_script)

HOST-LEVEL REPOSITORY FIXES:
- tools/pve/post-pve-install.sh: Debian + Proxmox PVE repos
- tools/pve/post-pbs-install.sh: Debian + Proxmox PBS repos
- tools/pve/pve8-upgrade.sh: Debian + Proxmox PVE + Ceph repos
- tools/pve/pbs3-upgrade.sh: Debian + Proxmox PBS repos
- tools/pve/hw-acceleration.sh: Debian non-free repos (deb + deb-src)
- install/proxmox-backup-server-install.sh: Proxmox PBS repo
- install/medusa-install.sh: Debian non-free repo
- install/globaleaks-install.sh: GlobaLeaks repository

CHANGES:
✅ All http:// → https:// for package downloads
✅ All http:// → https:// for repository configurations
✅ Added --proto '=https' to curl commands for protocol enforcement
✅ Improved quoting for file variables

IMPACT:
- Prevents MITM attacks on package installations
- Prevents MITM attacks on repository configuration
- Enforces TLS transport security across all downloads
- Brings consistency with security best practices

CVSS: 6.5 (Medium) - CWE-494, CWE-300, CWE-829
This commit is contained in:
Security Fix
2026-06-08 21:20:24 +02:00
parent 131545081c
commit 7d62e8319e
11 changed files with 30 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/pve/hw-acceleration.sh
+6 -6
View File
@@ -96,14 +96,14 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
msg_info "Installing Hardware Acceleration (non-free)"
pct exec "${privileged_container}" -- bash -c "cat <<EOF >/etc/apt/sources.list.d/non-free.list
deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
deb https://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
deb-src https://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
deb http://deb.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
deb https://deb.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
deb-src https://deb.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
deb http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
deb https://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
deb-src https://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
EOF"
pct exec "${privileged_container}" -- bash -c "silent() { \"\$@\" >/dev/null 2>&1; } && $STD apt-get update && $STD apt-get install -y intel-media-va-driver-non-free ocl-icd-libopencl1 intel-opencl-icd vainfo intel-gpu-tools && $STD adduser \$(id -u -n) video && $STD adduser \$(id -u -n) render"
tools/pve/pbs3-upgrade.sh
+4 -4
View File
@@ -71,9 +71,9 @@ start_routines() {
yes)
msg_info "Changing to Proxmox Backup Server 3 Sources"
cat <<EOF >/etc/apt/sources.list
deb http://deb.debian.org/debian bookworm main contrib
deb http://deb.debian.org/debian bookworm-updates main contrib
deb http://security.debian.org/debian-security bookworm-security main contrib
deb https://deb.debian.org/debian bookworm main contrib
deb https://deb.debian.org/debian bookworm-updates main contrib
deb https://security.debian.org/debian-security bookworm-security main contrib
EOF
msg_ok "Changed to Proxmox Backup Server 3 Sources"
;;
@@ -105,7 +105,7 @@ EOF
yes)
msg_info "Enabling 'pbs-no-subscription' repository"
cat <<EOF >/etc/apt/sources.list.d/pbs-install-repo.list
deb http://download.proxmox.com/debian/pbs bookworm pbs-no-subscription
deb https://download.proxmox.com/debian/pbs bookworm pbs-no-subscription
EOF
msg_ok "Enabled 'pbs-no-subscription' repository"
;;
tools/pve/post-pbs-install.sh
+3 -3
View File
@@ -126,9 +126,9 @@ start_routines_3() {
yes)
msg_info "Correcting Debian Sources"
cat <<EOF >/etc/apt/sources.list
deb http://deb.debian.org/debian ${VERSION} main contrib
deb http://deb.debian.org/debian ${VERSION}-updates main contrib
deb http://security.debian.org/debian-security ${VERSION}-security main contrib
deb https://deb.debian.org/debian ${VERSION} main contrib
deb https://deb.debian.org/debian ${VERSION}-updates main contrib
deb https://security.debian.org/debian-security ${VERSION}-security main contrib
EOF
msg_ok "Corrected Debian Sources"
;;
tools/pve/post-pve-install.sh
+4 -4
View File
@@ -115,9 +115,9 @@ start_routines_8() {
yes)
msg_info "Correcting Proxmox VE Sources"
cat <<EOF >/etc/apt/sources.list
deb http://deb.debian.org/debian bookworm main contrib
deb http://deb.debian.org/debian bookworm-updates main contrib
deb http://security.debian.org/debian-security bookworm-security main contrib
deb https://deb.debian.org/debian bookworm main contrib
deb https://deb.debian.org/debian bookworm-updates main contrib
deb https://security.debian.org/debian-security bookworm-security main contrib
EOF
echo 'APT::Get::Update::SourceListWarnings::NonFreeFirmware "false";' >/etc/apt/apt.conf.d/no-bookworm-firmware.conf
msg_ok "Corrected Proxmox VE Sources"
@@ -146,7 +146,7 @@ EOF
yes)
msg_info "Enabling 'pve-no-subscription' repository"
cat <<EOF >/etc/apt/sources.list.d/pve-install-repo.list
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription
deb https://download.proxmox.com/debian/pve bookworm pve-no-subscription
EOF
msg_ok "Enabled 'pve-no-subscription' repository"
;;
tools/pve/pve8-upgrade.sh
+4 -4
View File
@@ -54,9 +54,9 @@ start_routines() {
whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox --title "PVE8 SOURCES" "This will set the correct sources to update and install Proxmox VE 8." 10 58
msg_info "Changing to Proxmox VE 8 Sources"
cat <<EOF >/etc/apt/sources.list
deb http://ftp.debian.org/debian bookworm main contrib
deb http://ftp.debian.org/debian bookworm-updates main contrib
deb http://security.debian.org/debian-security bookworm-security main contrib
deb https://ftp.debian.org/debian bookworm main contrib
deb https://ftp.debian.org/debian bookworm-updates main contrib
deb https://security.debian.org/debian-security bookworm-security main contrib
EOF
msg_ok "Changed to Proxmox VE 8 Sources"
@@ -70,7 +70,7 @@ EOF
whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox --title "PVE8-NO-SUBSCRIPTION" "The 'pve-no-subscription' repository provides access to all of the open-source components of Proxmox VE." 10 58
msg_info "Enabling 'pve-no-subscription' repository"
cat <<EOF >/etc/apt/sources.list.d/pve-install-repo.list
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription
deb https://download.proxmox.com/debian/pve bookworm pve-no-subscription
EOF
msg_ok "Enabled 'pve-no-subscription' repository"