CVE-2020-11061: In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via…

PriorityP340high7.4CVSS 3.1

AVNACLPRLUINSCCLILAL

EPSS

1.24%

66.2th percentile

In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
bacula	bacula	>= 0 < 9.6.5-1	9.6.5-1
bacula	bacula	>= 0 < 9.6.5-1	9.6.5-1
bacula	bacula	>= 0 < 9.6.5-1	9.6.5-1
bacula	bacula	>= 0 < 9.6.5-1	9.6.5-1
bareos	bareos	<= 16.2.10	—
bareos	bareos	—	—
bareos	bareos	17.2.4 – 17.2.9	—
bareos	bareos	18.2.5 – 18.2.8	—
bareos	bareos	18.4.1 – 19.2.7	—
bareos_gmbh_co_kg	bareos_director	<= 16.2.10	—
debian	bacula	< bacula 9.6.5-1 (bookworm)	bacula 9.6.5-1 (bookworm)
debian	debian_linux	—	—

CVSS provenance

nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

osv7.4HIGH

vendor_debian6.0MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.