Proxmox/ProxmoxVE
1
0
Fork 1
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-06-09 09:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

security: Fix MITM RCE vulnerability in microcode scripts

Browse Source 
- Changed Intel microcode download from HTTP to HTTPS
- Added --proto '=https' flag to curl to prevent protocol downgrade attacks
- Simplified output parameter from basename to direct variable reference
- Affects: tools/pve/microcode.sh (line 79) and tools/pve/pbs-microcode.sh (line 93)
- CVSS: 6.5 (Medium) - CWE-494, CWE-300, CWE-829
- Impact: Prevents network-path MITM attacks that could lead to root RCE

The AMD branch was already using HTTPS, this fix brings Intel branch
to parity and closes the vulnerability reported in security advisory.
This commit is contained in:
Security Fix
2026-06-08 21:10:11 +02:00
parent 131545081c
commit ab549baa1f
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/pve/microcode.sh
+1 -1
View File
@@ -76,7 +76,7 @@ intel() {
}
msg_info "Downloading the Intel Processor Microcode Package $microcode"
curl -fsSL "http://ftp.debian.org/debian/pool/non-free-firmware/i/intel-microcode/$microcode" -o $(basename "http://ftp.debian.org/debian/pool/non-free-firmware/i/intel-microcode/$microcode")
curl -fsSL --proto '=https' "https://ftp.debian.org/debian/pool/non-free-firmware/i/intel-microcode/$microcode" -o "$microcode"
msg_ok "Downloaded the Intel Processor Microcode Package $microcode"
msg_info "Installing $microcode (Patience)"
tools/pve/pbs-microcode.sh
+1 -1
View File
@@ -90,7 +90,7 @@ intel() {
}
msg_info "Downloading Intel processor microcode package $microcode"
curl -fsSL "http://ftp.debian.org/debian/pool/non-free-firmware/i/intel-microcode/$microcode" -o $(basename "http://ftp.debian.org/debian/pool/non-free-firmware/i/intel-microcode/$microcode")
curl -fsSL --proto '=https' "https://ftp.debian.org/debian/pool/non-free-firmware/i/intel-microcode/$microcode" -o "$microcode"
msg_ok "Downloaded Intel processor microcode package $microcode"
msg_info "Installing $microcode (this might take a while)"