mirror of
https://github.com/community-scripts/ProxmoxVE.git
synced 2026-07-08 23:22:13 +02:00
Security Fix
7d62e8319e
CRITICAL FIXES (CWE-494, CWE-300): - tools/pve/microcode.sh:79 (Intel microcode) - tools/pve/pbs-microcode.sh:93 (Intel microcode) CONTAINER-LEVEL FIXES: - install/deconz-install.sh: libssl1.1 .deb + setup_deb822_repo URLs - install/odoo-install.sh: lxml-clean .deb - ct/odoo.sh: lxml-clean .deb (update_script) HOST-LEVEL REPOSITORY FIXES: - tools/pve/post-pve-install.sh: Debian + Proxmox PVE repos - tools/pve/post-pbs-install.sh: Debian + Proxmox PBS repos - tools/pve/pve8-upgrade.sh: Debian + Proxmox PVE + Ceph repos - tools/pve/pbs3-upgrade.sh: Debian + Proxmox PBS repos - tools/pve/hw-acceleration.sh: Debian non-free repos (deb + deb-src) - install/proxmox-backup-server-install.sh: Proxmox PBS repo - install/medusa-install.sh: Debian non-free repo - install/globaleaks-install.sh: GlobaLeaks repository CHANGES: ✅ All http:// → https:// for package downloads ✅ All http:// → https:// for repository configurations ✅ Added --proto '=https' to curl commands for protocol enforcement ✅ Improved quoting for file variables IMPACT: - Prevents MITM attacks on package installations - Prevents MITM attacks on repository configuration - Enforces TLS transport security across all downloads - Brings consistency with security best practices CVSS: 6.5 (Medium) - CWE-494, CWE-300, CWE-829
27 lines
976 B
Bash
27 lines
976 B
Bash
#!/usr/bin/env bash
|
|
# Copyright (c) 2021-2026 community-scripts ORG
|
|
# Author: Giovanni Pellerano (evilaliv3)
|
|
# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
|
|
# Source: https://github.com/globaleaks/globaleaks-whistleblowing-software
|
|
|
|
source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
|
|
color
|
|
verb_ip6
|
|
catch_errors
|
|
setting_up_container
|
|
network_check
|
|
update_os
|
|
|
|
msg_info "Setup GlobaLeaks"
|
|
DISTRO_CODENAME="$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)"
|
|
curl -fsSL https://deb.globaleaks.org/globaleaks.asc | gpg --dearmor -o /etc/apt/trusted.gpg.d/globaleaks.gpg
|
|
echo "deb [signed-by=/etc/apt/trusted.gpg.d/globaleaks.gpg] https://deb.globaleaks.org $DISTRO_CODENAME/" >/etc/apt/sources.list.d/globaleaks.list
|
|
echo 'APPARMOR_SANDBOXING=0' >/etc/default/globaleaks
|
|
$STD apt update
|
|
$STD apt -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold install globaleaks
|
|
msg_ok "Setup GlobaLeaks"
|
|
|
|
motd_ssh
|
|
customize
|
|
cleanup_lxc
|