Buffer overflow in Bareos
CVE-2020-11061
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.
Vulnerability class: Buffer Overflow
EPSS: 0.012 (66.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L.
Affected products
- Bareos — versions 18.2.4
- Bareos Gmbh & Co. Kg Director — versions <= 16.2.10, <= 17.2.9, <= 18.2.8
- Debian Debian_linux — versions 9.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
- security-advisories@github.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-11061?
- CVE-2020-11061 is a medium-severity vulnerability in Bareos, classified under Heap-based Buffer Overflow. CVSS score: 6.0/10. Published 2020-07-10.
- How severe is CVE-2020-11061?
- Medium severity. CVSS v3 base score is 6.0 out of 10.