title: Heap-based Buffer Overflow in Bareos Director
description: In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.
problem types: CWE-122: Heap-based Buffer Overflow
affected:
{
product: Bareos Director
vendor: Bareos GmbH & Co. KG
versions:
status: affected, version: <= 16.2.10
status: affected, version: <= 17.2.9
status: affected, version: <= 18.2.8
status: affected, version: <= 19.2.7
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
]