Inquiry on CVE-2024-9486

[nathanlin1234]

Hi Proxmox team, can you please advise is CVE-2024-9686 (https://nvd.nist.gov/vuln/detail/CVE-2024-9486) any concern for the Proxmox VE stack itself? Or it's an isolated configuration issue on the Kubernetes Image Builder project?

Thank you.

 

[esi_y]

Proxmox do not track CVEs: https://bugzilla.proxmox.com/show_bug.cgi?id=4579#c3

 

[BobhWasatch]

I think it is pretty clear that the CVE is about the Image Builder and not PVE itself.

 

[t.lamprecht]

Hello,

First please disregard the first replier, their reply takes things out of context and is not related to your question at all, we take security implications and reporting very seriously, but do not rely on requesting CVE numbers ourself due to a multitude of fine-grained reasons. Our security reporting guide is here: https://pve.proxmox.com/wiki/Security_Reporting

Anyhow,

can you please advise is CVE-2024-9686 (https://nvd.nist.gov/vuln/detail/CVE-2024-9486) any concern for the Proxmox VE stack itself?

No, there are no concerns for the Proxmox VE stack itself w.r.t. this issue, it is for a third-party project that can build images of some OS targeting Proxmox VE as platform to run those images.
We do not use this project ourselves nor does anything in Proxmox VE relies on it.

Or it's an isolated configuration issue on the Kubernetes Image Builder project?

Exactly.

 

[esi_y]

I think it is pretty clear that the CVE is about the Image Builder and not PVE itself.

That is correct.

First please disregard the first replier, their reply takes things out of context and is not related to your question at all

It is related insofar even if it was related to PVE stack, you would need to get it reported via your own channels.

No, there are no concerns for the Proxmox VE stack itself w.r.t. this issue, it is for a third-party project that can build images of some OS targeting Proxmox VE as platform to run those images.

I kind of suspect the OP knows this from the way the CVE was filed. But he might be running those VMs built like that, so I would at least advise him to care about the VMs, not the host/nodes.

 

[nathanlin1234]

Thank you so much. Really appreciate all the responses!