proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-10-04 00:02:57 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bump version to 8.1.3

Browse Source 
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2024-03-22 14:14:39 +01:00
parent bb34ca534e
commit 787e4c06e3
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
debian/changelog vendored
View File

@ -1,3 +1,22 @@
libpve-access-control (8.1.3) bookworm; urgency=medium
* user: password change: require confirmation-password parameter so that
anybody gaining local or physical access to a device where a user is
logged in on a Proxmox VE web-interface cannot give them more permanent
access or deny the actual user accessing their account by changing the
password. Note that such an attack scenario means that the attacker
already has high privileges and can already control the resource
completely through another attack.
Such initial attacks (like stealing an unlocked device) are almost always
are outside of the control of our projects. Still, hardening the API a bit
by requiring a confirmation of the original password is to cheap to
implement to not do so.
* jobs: realm sync: fix scheduled LDAP syncs not applying all attributes,
like comments, correctly
-- Proxmox Support Team <support@proxmox.com> Fri, 22 Mar 2024 14:14:36 +0100
libpve-access-control (8.1.2) bookworm; urgency=medium
* add Sys.AccessNetwork privilege