Security Fix 7d62e8319e security: Fix HTTP to HTTPS for all package and repository downloads ...

CRITICAL FIXES (CWE-494, CWE-300):
- tools/pve/microcode.sh:79 (Intel microcode)
- tools/pve/pbs-microcode.sh:93 (Intel microcode)

CONTAINER-LEVEL FIXES:
- install/deconz-install.sh: libssl1.1 .deb + setup_deb822_repo URLs
- install/odoo-install.sh: lxml-clean .deb
- ct/odoo.sh: lxml-clean .deb (update_script)

HOST-LEVEL REPOSITORY FIXES:
- tools/pve/post-pve-install.sh: Debian + Proxmox PVE repos
- tools/pve/post-pbs-install.sh: Debian + Proxmox PBS repos
- tools/pve/pve8-upgrade.sh: Debian + Proxmox PVE + Ceph repos
- tools/pve/pbs3-upgrade.sh: Debian + Proxmox PBS repos
- tools/pve/hw-acceleration.sh: Debian non-free repos (deb + deb-src)
- install/proxmox-backup-server-install.sh: Proxmox PBS repo
- install/medusa-install.sh: Debian non-free repo
- install/globaleaks-install.sh: GlobaLeaks repository

CHANGES:
✅ All http:// → https:// for package downloads
✅ All http:// → https:// for repository configurations
✅ Added --proto '=https' to curl commands for protocol enforcement
✅ Improved quoting for file variables

IMPACT:
- Prevents MITM attacks on package installations
- Prevents MITM attacks on repository configuration
- Enforces TLS transport security across all downloads
- Brings consistency with security best practices

CVSS: 6.5 (Medium) - CWE-494, CWE-300, CWE-829

2026-06-08 21:26:18 +02:00

..

addon

fix(netdata): extend PVE version support to 9.x (#14714)

2026-05-26 08:03:43 +02:00

copy-data

chore: bump copyright to 2026 - happy new year (#10585)

2026-01-06 13:28:12 +01:00

headers

SparkyFitness-Garmin: fix app name (#13325)

2026-03-26 22:08:45 +01:00

pve

security: Fix HTTP to HTTPS for all package and repository downloads

2026-06-08 21:26:18 +02:00