Security Fix ab549baa1f security: Fix MITM RCE vulnerability in microcode scripts ...

- Changed Intel microcode download from HTTP to HTTPS
- Added --proto '=https' flag to curl to prevent protocol downgrade attacks
- Simplified output parameter from basename to direct variable reference
- Affects: tools/pve/microcode.sh (line 79) and tools/pve/pbs-microcode.sh (line 93)
- CVSS: 6.5 (Medium) - CWE-494, CWE-300, CWE-829
- Impact: Prevents network-path MITM attacks that could lead to root RCE

The AMD branch was already using HTTPS, this fix brings Intel branch
to parity and closes the vulnerability reported in security advisory.

2026-06-08 21:10:11 +02:00

..

addon

fix(netdata): extend PVE version support to 9.x (#14714)

2026-05-26 08:03:43 +02:00

copy-data

chore: bump copyright to 2026 - happy new year (#10585)

2026-01-06 13:28:12 +01:00

headers

SparkyFitness-Garmin: fix app name (#13325)

2026-03-26 22:08:45 +01:00

pve

security: Fix MITM RCE vulnerability in microcode scripts

2026-06-08 21:10:11 +02:00