{"id":"UBUNTU-CVE-2020-11061","details":"In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.","modified":"2025-10-24T04:48:24Z","published":"2020-07-10T20:15:00Z","upstream":["CVE-2020-11061"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2020-11061"},{"type":"REPORT","url":"https://bugs.bareos.org/view.php?id=1210"},{"type":"REPORT","url":"https://github.com/bareos/bareos/security/advisories/GHSA-mm45-cg35-54j4"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2020-11061"}],"affected":[{"package":{"name":"bacula","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/bacula@7.0.5+dfsg-4ubuntu0.1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.6+dfsg-9.1ubuntu4","7.0.5+dfsg-4","7.0.5+dfsg-4build1","7.0.5+dfsg-4ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_name":"bacula","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_version":"7.0.5+dfsg-4ubuntu0.1","binary_name":"bacula-client"},{"binary_version":"7.0.5+dfsg-4ubuntu0.1","binary_name":"bacula-common"},{"binary_name":"bacula-common-mysql","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-common-pgsql","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-common-sqlite3","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-console","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-console-qt","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-director-common","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-director-mysql","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_version":"7.0.5+dfsg-4ubuntu0.1","binary_name":"bacula-director-pgsql"},{"binary_name":"bacula-director-sqlite3","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-fd","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-sd","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-sd-mysql","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_version":"7.0.5+dfsg-4ubuntu0.1","binary_name":"bacula-sd-pgsql"},{"binary_name":"bacula-sd-sqlite3","binary_version":"7.0.5+dfsg-4ubuntu0.1"},{"binary_name":"bacula-server","binary_version":"7.0.5+dfsg-4ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-11061.json"}},{"package":{"name":"bareos","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/bareos@14.2.6-3?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.2.5-1","14.2.5-2","14.2.6-1","14.2.6-2","14.2.6-2build1","14.2.6-3"],"ecosystem_specific":{"binaries":[{"binary_name":"bareos","binary_version":"14.2.6-3"},{"binary_name":"bareos-bat","binary_version":"14.2.6-3"},{"binary_name":"bareos-bconsole","binary_version":"14.2.6-3"},{"binary_name":"bareos-client","binary_version":"14.2.6-3"},{"binary_name":"bareos-common","binary_version":"14.2.6-3"},{"binary_name":"bareos-database-common","binary_version":"14.2.6-3"},{"binary_name":"bareos-database-mysql","binary_version":"14.2.6-3"},{"binary_name":"bareos-database-postgresql","binary_version":"14.2.6-3"},{"binary_name":"bareos-database-sqlite3","binary_version":"14.2.6-3"},{"binary_name":"bareos-database-tools","binary_version":"14.2.6-3"},{"binary_name":"bareos-devel","binary_version":"14.2.6-3"},{"binary_name":"bareos-director","binary_version":"14.2.6-3"},{"binary_name":"bareos-director-python-plugin","binary_version":"14.2.6-3"},{"binary_name":"bareos-filedaemon","binary_version":"14.2.6-3"},{"binary_version":"14.2.6-3","binary_name":"bareos-filedaemon-python-plugin"},{"binary_name":"bareos-storage","binary_version":"14.2.6-3"},{"binary_name":"bareos-storage-fifo","binary_version":"14.2.6-3"},{"binary_name":"bareos-storage-python-plugin","binary_version":"14.2.6-3"},{"binary_name":"bareos-storage-tape","binary_version":"14.2.6-3"},{"binary_name":"bareos-tools","binary_version":"14.2.6-3"},{"binary_name":"bareos-traymonitor","binary_version":"14.2.6-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-11061.json"}},{"package":{"name":"bacula","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/bacula@9.0.6-1build1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.4+dfsg-6","9.0.4+dfsg-3","9.0.5+dfsg-1","9.0.5+dfsg-3","9.0.5+dfsg-4","9.0.6-1","9.0.6-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"bacula","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-bscan","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-client","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-common","binary_version":"9.0.6-1build1"},{"binary_version":"9.0.6-1build1","binary_name":"bacula-common-mysql"},{"binary_name":"bacula-common-pgsql","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-common-sqlite3","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-console","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-console-qt","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-director","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-director-common","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-director-mysql","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-director-pgsql","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-director-sqlite3","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-fd","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-sd","binary_version":"9.0.6-1build1"},{"binary_name":"bacula-server","binary_version":"9.0.6-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-11061.json"}},{"package":{"name":"bacula","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/bacula@9.4.2-2ubuntu5?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.2-2ubuntu3","9.4.2-2ubuntu4","9.4.2-2ubuntu5"],"ecosystem_specific":{"binaries":[{"binary_version":"9.4.2-2ubuntu5","binary_name":"bacula"},{"binary_name":"bacula-bscan","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-client","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-common","binary_version":"9.4.2-2ubuntu5"},{"binary_version":"9.4.2-2ubuntu5","binary_name":"bacula-common-mysql"},{"binary_name":"bacula-common-pgsql","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-common-sqlite3","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-console","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-console-qt","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-director","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-director-common","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-director-mysql","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-director-pgsql","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-director-sqlite3","binary_version":"9.4.2-2ubuntu5"},{"binary_version":"9.4.2-2ubuntu5","binary_name":"bacula-fd"},{"binary_name":"bacula-sd","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-server","binary_version":"9.4.2-2ubuntu5"},{"binary_name":"bacula-tray-monitor","binary_version":"9.4.2-2ubuntu5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-11061.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}]}