CVE-2022-24756 — HIGH (7.5)

Vulnerability Description

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that is able to use the PAM Console (i.e. by knowing the shared secret or via the WebUI) can flood the Director with failing login attempts which will eventually lead to an out-of-memory condition in which the Director will not work anymore. Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 contain a Bugfix for this problem. Users who are unable to upgrade may disable PAM authentication as a workaround.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Bareos	Bareos	>= 18.2, < 19.2.12

Related Weaknesses (CWE)

CWE-401

References

https://github.com/bareos/bareos/pull/1115PatchThird Party Advisory
https://github.com/bareos/bareos/pull/1119PatchThird Party Advisory
https://github.com/bareos/bareos/pull/1121PatchThird Party Advisory
https://github.com/bareos/bareos/security/advisories/GHSA-jh55-4wgw-xc9jThird Party Advisory
https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/ExploitPatchThird Party Advisory
https://github.com/bareos/bareos/pull/1115PatchThird Party Advisory
https://github.com/bareos/bareos/pull/1119PatchThird Party Advisory
https://github.com/bareos/bareos/pull/1121PatchThird Party Advisory
https://github.com/bareos/bareos/security/advisories/GHSA-jh55-4wgw-xc9jThird Party Advisory
https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/ExploitPatchThird Party Advisory

FAQ

What is CVE-2022-24756?

CVE-2022-24756 is a vulnerability with a CVSS score of 7.5 (HIGH). Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM ...

How severe is CVE-2022-24756?

CVE-2022-24756 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-24756?

Check the references section above for vendor advisories and patch information. Affected products include: Bareos Bareos.