CVE-2023-30577

2023-07-2600:00:00

ubuntu.com

amanda

maryland

network disk archiver

cve-2023-30577

vulnerability

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.002

Percentile

57.3%

JSON

AMANDA (Advanced Maryland Automatic Network Disk Archiver) before
tag-community-3.5.4 mishandles argument checking for runtar.c, a different
vulnerability than CVE-2022-37705.

Notes

Author	Note
	Priority reason: requires access to the non-default backup group to exploit
sbeattie	requires access to the non-default backup group to exploit upstream fixing commits incorrectly refer to CVE-2023-30547

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchamanda< 1:3.5.1-1ubuntu0.3+esm1UNKNOWN
ubuntu20.04noarchamanda< 1:3.5.1-2ubuntu0.4UNKNOWN
ubuntu22.04noarchamanda< 1:3.5.1-8ubuntu1.4UNKNOWN
ubuntu23.10noarchamanda< 1:3.5.1-11ubuntu0.23.10.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	amanda	< 1:3.5.1-1ubuntu0.3+esm1	UNKNOWN
ubuntu	20.04	noarch	amanda	< 1:3.5.1-2ubuntu0.4	UNKNOWN
ubuntu	22.04	noarch	amanda	< 1:3.5.1-8ubuntu1.4	UNKNOWN
ubuntu	23.10	noarch	amanda	< 1:3.5.1-11ubuntu0.23.10.1	UNKNOWN