CVE-2020-11061

MEDIUM

Bareos Director <= 16.2.10, 17.2.9, 18.2.8, 19.2.7 - Buffer Overflow

Title source: llm
STIX 2.1

Description

In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
https://bugs.bareos.org/view.php?id=1210
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/08/msg00051.html

Scores

CVSS v3 6.0
EPSS 0.0091
EPSS Percentile 75.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Details

CWE
CWE-122 CWE-787
Status published
Products (3)
bareos/bareos 18.2.4 rc1 (2 CPE variants)
bareos/bareos < 16.2.10
debian/debian_linux 9.0
Published Jul 10, 2020
Tracked Since Feb 18, 2026