CVE-2022-2787

NameCVE-2022-2787
DescriptionSchroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3075-1, DSA-5213-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
schroot (PTS)bullseye (security), bullseye1.6.10-12+deb11u1fixed
bookworm1.6.13-3fixed
forky, sid, trixie1.6.13-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
schrootsourcebuster1.6.10-6+deb10u1DLA-3075-1
schrootsourcebullseye1.6.10-12+deb11u1DSA-5213-1
schrootsource(unstable)1.6.12-2

Notes

https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d
Search for package or bug name: Reporting problems