Heap-based Buffer Overflow in Bareos Director
Priority LOW 35CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.
Why it matters now
EPSS 0.0124 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bareos GmbH & Co. KG | Bareos Director | up to 16.2.10; up to 17.2.9; up to 18.2.8; up to 19.2.7 | — | No fix listed | CNA |
- Bareos Director VendorBareos GmbH & Co. KG Affected up to 16.2.10; up to 17.2.9; up to 18.2.8; up to 19.2.7 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bareos:bareos:*:*:*:*:*:*:*:* | up to 16.2.10; 17.2.4 – 17.2.9; 18.2.5 – 18.2.8; 18.4.1 – 19.2.7 | Vulnerable | bareos |
| cpe:2.3:a:bareos:bareos:18.2.4:rc1:*:*:*:*:*:* | 18.2.4 rc1 | Vulnerable | bareos |
| cpe:2.3:a:bareos:bareos:18.2.4:rc2:*:*:*:*:*:* | 18.2.4 rc2 | Vulnerable | bareos |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:bareos:bareos:*:*:*:*:*:*:*:* Versions up to 16.2.10; 17.2.4 – 17.2.9; 18.2.5 – 18.2.8; 18.4.1 – 19.2.7 Vulnerable ·bareos
- cpe:2.3:a:bareos:bareos:18.2.4:rc1:*:*:*:*:*:* Versions 18.2.4 rc1 Vulnerable ·bareos
- cpe:2.3:a:bareos:bareos:18.2.4:rc2:*:*:*:*:*:* Versions 18.2.4 rc2 Vulnerable ·bareos
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11061
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences