CVE-2022-24756

    Dashboard / Vulnerabilities / CVE-2022-24756

    CVE-2022-24756

    Published: 15 Mar 2022Last Modified: 21 Oct 2026

    Summary: Missing Release of Memory after Effective Lifetime in Bareos Director

    Details: Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that is able to use the PAM Console (i.e. by knowing the shared secret or via the WebUI) can flood the Director with failing login attempts which will eventually lead to an out-of-memory condition in which the Director will not work anymore. Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 contain a Bugfix for this problem. Users who are unable to upgrade may disable PAM authentication as a workaround.

    References: https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24756.json, https://github.com/bareos/bareos/security/advisories/GHSA-jh55-4wgw-xc9j, https://nvd.nist.gov/vuln/detail/CVE-2022-24756, https://github.com/bareos/bareos/pull/1115, https://github.com/bareos/bareos/pull/1119, https://github.com/bareos/bareos/pull/1121

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a8511c39239f4c0a48ad7f88700aabfe7e0bff9a

    Affected versions

    WIP/21.0.1-pre
    WIP/21.0.0-pre

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24756 | CVE-DB