+libpve-access-control (7.2-5) bullseye; urgency=medium
+
+ * api: realm sync: avoid separate log line for "remove-vanished" opt
+
+ * auth ldap/ad: compare group member dn case-insensitively
+
+ * two factor auth: only lock tfa config for recovery keys
+
+ * privs: add Sys.Incoming for guarding cross-cluster data streams like guest
+ migrations and storage migrations
+
+ -- Proxmox Support Team <support@proxmox.com> Thu, 17 Nov 2022 13:09:17 +0100
+
+libpve-access-control (7.2-4) bullseye; urgency=medium
+
+ * fix #4074: increase API OpenID code size limit to 2048
+
+ * auth key: protect against rare chance of a double rotation in clusters,
+ leaving the potential that some set of nodes have the earlier key cached,
+ that then got rotated out due to the race, resulting in a possible other
+ set of nodes having the newer key cached. This is a split view of the auth
+ key and may resulting in spurious failures if API requests are made to a
+ different node than the ticket was generated on.
+ In addition to that, the "keep validity of old tickets if signed in the
+ last two hours before rotation" logic was disabled too in such a case,
+ making such tickets invalid too early.
+ Note that both are cases where Proxmox VE was too strict, so while this
+ had no security implications it can be a nuisance, especially for
+ environments that use the API through an automated or scripted way
+
+ -- Proxmox Support Team <support@proxmox.com> Thu, 14 Jul 2022 08:36:51 +0200
+
+libpve-access-control (7.2-3) bullseye; urgency=medium
+
+ * api: token: use userid-group as API perm check to avoid being overly
+ strict through a misguided use of user id for non-root users.
+
+ * perm check: forbid undefined/empty ACL path for future proofing of against
+ above issue
+
+ -- Proxmox Support Team <support@proxmox.com> Mon, 20 Jun 2022 15:51:14 +0200
+
+libpve-access-control (7.2-2) bullseye; urgency=medium
+
+ * permissions: merge propagation flag for multiple roles on a path that
+ share privilege in a deterministic way, to avoid that it gets lost
+ depending on perl's random sort, which would result in returing less
+ privileges than an auth-id actually had.
+
+ * permissions: avoid that token and user privilege intersection is to strict
+ for user permissions that have propagation disabled.
+
+ -- Proxmox Support Team <support@proxmox.com> Fri, 03 Jun 2022 14:02:30 +0200
+
libpve-access-control (7.2-1) bullseye; urgency=medium
* user check: fix expiration/enable order
* add realm sub commands to pveum CLI tool
- * api: domains: add user group sync API enpoint
+ * api: domains: add user group sync API endpoint
* allow one to sync and import users and groups from LDAP/AD based realms
libpve-access-control (5.1-9) unstable; urgency=medium
* store the tfa type in user.cfg allowing to get it without proxying the call
- to a higher priviledged daemon.
+ to a higher privileged daemon.
* tfa: realm required TFA should lock out users without TFA configured, as it
was done before Proxmox VE 5.4
libpve-access-control (3.0-3) unstable; urgency=low
- * Add new role PVETemplateUser (and VM.Clone priviledge)
+ * Add new role PVETemplateUser (and VM.Clone privilege)
-- Proxmox Support Team <support@proxmox.com> Mon, 29 Apr 2013 11:42:15 +0200
libpve-access-control (1.0-18) unstable; urgency=low
- * fix bug #151: corretly parse username inside ticket
+ * fix bug #151: correctly parse username inside ticket
* fix bug #152: allow user to change his own password
libpve-access-control (1.0-3) unstable; urgency=low
* add support for delayed parameter parsing - We need that to disable
- file upload for normal API request (avoid DOS attacs)
+ file upload for normal API request (avoid DOS attacks)
-- Proxmox Support Team <support@proxmox.com> Fri, 02 Dec 2011 09:56:10 +0100
projects / pve-access-control.git / blobdiff