CVE-2022-24756

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-24756
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24756.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24756
Aliases
  • GHSA-jh55-4wgw-xc9j
Downstream
Published
2022-03-15T14:40:21Z
Modified
2025-12-04T10:17:49.451773Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Missing Release of Memory after Effective Lifetime in Bareos Director
Details

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that is able to use the PAM Console (i.e. by knowing the shared secret or via the WebUI) can flood the Director with failing login attempts which will eventually lead to an out-of-memory condition in which the Director will not work anymore. Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 contain a Bugfix for this problem. Users who are unable to upgrade may disable PAM authentication as a workaround.

Database specific 
{
    "cwe_ids": [
        "CWE-401"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24756.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/bareos/bareos

Affected ranges

Type
GIT
Repo
https://github.com/bareos/bareos
Events
Introduced
58bc1c261ccdf13c905179d8d5e044bc7cc4c993
Fixed
3f591d73218da99e6b81475f711c5e82ea2245de
Database specific 
{
    "versions": [
        {
            "introduced": "20.0.0"
        },
        {
            "fixed": "20.0.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/bareos/bareos
Events
Introduced
8ba6c23bb177b0bb437ef75dacf90259690e7e8f
Fixed
fa116033aca84c29da1bda2b73da00afdc02cba5
Database specific 
{
    "versions": [
        {
            "introduced": "21.0.0"
        },
        {
            "fixed": "21.1.0"
        }
    ]
}

Affected versions

Release/20.*

Release/20.0.0
Release/20.0.1
Release/20.0.2
Release/20.0.3
Release/20.0.4
Release/20.0.5

Release/21.*

Release/21.0.0

WIP/20.*

WIP/20.0.0-pre
WIP/20.0.1-pre
WIP/20.0.2-pre
WIP/20.0.3-pre
WIP/20.0.4-pre
WIP/20.0.5-pre

WIP/21.*

WIP/21.0.0-pre
WIP/21.0.1-pre