Latest activity
-
TTheMrg reacted to kore's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with
Like.
To be honest, I'm sick of this whole discussion. The newly registered users who were actually affected have already admitted that running an outdated system was a mistake. Meanwhile, some of the so-called veteran users on this forum just keep... -
dcsapak replied to the thread (open source) PMG Quarantine Admin - mobile-first admin console for PMG (quarantine, tracking center, dashboard) + live demo.hi, nice work. Did you consider sending patches directly instead of making a standalone thing? While we're probably wouldn't integrate react+vite, we're using our own rust based ui framework (that we use e.g. for the user quarantine mobile... -
fba reacted to asdpiasdjoi's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Found it. It is a complete compromise of the web interface. No pre-requisites, just a vulnerable proxmox version. There was a bug patched in pve-access-control (potentially by accident) in 2023. I will submit it to MITRE so a CVE can be issued... -
gurubert reacted to Bu66as's post in the thread OT: Debian erlaubt KI-Beiträge ohne Kennzeichnungspflicht with Like.
Der Lizenz-Punkt von @Johannes S ist eigentlich der spannendere, das Codestyle-Argument erledigt sich ja mit genug Nachdruck im Review. Beim DCO unterschreibst du nicht nur "ich steh dafür grade", sondern auch dass du das Recht hast, den Code... -
gurubert reacted to Johannes S's post in the thread OT: Debian erlaubt KI-Beiträge ohne Kennzeichnungspflicht with Like.
Du hast "Das Geschäftsmodell der AI-Codeassistenten beruht auf systematischen Verstoßen gegen Urheberrecht und opensource-Lizenzen" sehr umständlich ausgedrückt :) Weil auch wenn das Problem nicht grundsätzlich neu ist, erreicht es so doch eine...
-
gurubert reacted to Johannes S's post in the thread OT: Debian erlaubt KI-Beiträge ohne Kennzeichnungspflicht with Like.
Ich sehe ( und das als bekennender KI-Luddit!) auch nicht so das Problem. Im Grunde sagt Debian, dass „aber die ki sagt, das passt so“ keine erlaubte Ausrede ist Bullshit abzuliefern ;) OpenBSD hatte ja das Vergnügen mit einen Vibecoder, der...
-
gurubert reacted to Bu66as's post in the thread OT: Debian erlaubt KI-Beiträge ohne Kennzeichnungspflicht with Like.
Ehrlich gesagt ändert das bei Debian doch wenig, mit dem DCO lag die Verantwortung schon immer beim Einreicher. Ungeprüft zusammenkopierten Kram gab's auch vorher schon, halt von Stack Overflow statt vom LLM. Was real schützt ist der Review- und...
-
TTheMrg reacted to urog's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
You're absolutely right, and I accept the failure on my side. Just to clarify, this is informational, not a complaint. I'm sharing it so you're aware that this actually happened in our environment and can take it into account.
-
fba reacted to Johannes S's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Systems without current system updates can be hacked, nothing is "new" or "urgent" on this. And PVE7 and PVE8 won't get any security updates any more so it's somehow expected that they get owned. Even if you don't connect them directly to the...
-
TTheMrg reacted to pve7bug's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Thanks to the Proxmox team for reviewing my report. At least they took it seriously, unlike the users on this forum who think that a Debian 11 installation is hacked simply because it's EOL (and no, the OpenSSH bug doesn't affect Debian 11; it's...
-
fba reacted to Gilberto Ferreira's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
In any case, I don't think this is a 0day vulnerability, because on this is happen due to out date servers and bad servers administration, to say the least. Many of this vulnerabilities are well-know documented, such as kernel and ssh...
-
Ggnets posted the thread The PMG "daily admin report" is always sent twice when triggered automatically in Mail Gateway: Installation and configuration.Hello everyone Do any of you know this problem and how to solve it? The PMG "daily admin report" is always sent twice when triggered automatically. If I run the job manually (pmgreport --receiver admin@dummy.com --timespan today --auto), only...
-
Ppve7bug replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Thanks to the Proxmox team for reviewing my report. At least they took it seriously, unlike the users on this forum who think that a Debian 11 installation is hacked simply because it's EOL (and no, the OpenSSH bug doesn't affect Debian 11; it's...
-
UdoB reacted to Johannes S's post in the thread OT: Debian erlaubt KI-Beiträge ohne Kennzeichnungspflicht with Like.
Ich sehe ( und das als bekennender KI-Luddit!) auch nicht so das Problem. Im Grunde sagt Debian, dass „aber die ki sagt, das passt so“ keine erlaubte Ausrede ist Bullshit abzuliefern ;) OpenBSD hatte ja das Vergnügen mit einen Vibecoder, der... -
gurubert reacted to Johannes S's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Systems without current system updates can be hacked, nothing is "new" or "urgent" on this. And PVE7 and PVE8 won't get any security updates any more so it's somehow expected that they get owned. Even if you don't connect them directly to the...
-
gurubert reacted to leesteken's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
The usual use of the zero-day term is for vulnerabilities that are being exploited while there is no fix yet (for a supported/current version). That is something the administrator cannot do much about. This vulnerability is probably already fixed...
-
gurubert reacted to Gilberto Ferreira's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
In any case, I don't think this is a 0day vulnerability, because on this is happen due to out date servers and bad servers administration, to say the least. Many of this vulnerabilities are well-know documented, such as kernel and ssh...
-
fba replied to the thread VM networking with firewall - the dreaded 10th interface.Hi, you're right, either use shorter vm ids, less than 10 interfaces per vm or switch to the nftables backend, which doesn't use these fwbr-interfaces. You can also create a bug entry at bugzilla.proxmox.com and hope that this gets fixed in the...
-
VictorSTS reacted to t.lamprecht's post in the thread Ceph CVEs – keyring rotation strongly advised, probably required in the future with Like.
There is now a newer pve-manager with version 9.2.12 available on the pve-test repo and a backport of that as 8.4.22 for PVE 8's pvetest repo, matching our respective test repo of the ceph-squid and ceph-tentacle releases. There is some better... -
aaron replied to the thread Please add suspend/resume/hibernate button to web UI.https://pve.proxmox.com/wiki/Upgrade_from_8_to_9 :) Version 8 is now considered EOL -> https://pve.proxmox.com/wiki/FAQ Question 11