CVE-2024-45044

Name	CVE-2024-45044
Description	Bareos is open source software for backup, archiving, and recovery of data for operating systems. When a command ACL is in place and a user executes a command in bconsole using an abbreviation (i.e. "w" for "whoami") the ACL check did not apply to the full form (i.e. "whoami") but to the abbreviated form (i.e. "w"). If the command ACL is configured with negative ACL that should forbid using the "whoami" command, you could still use "w" or "who" as a command successfully. Fixes for the problem are shipped in Bareos versions 23.0.4, 22.1.6 and 21.1.11. If only positive command ACLs are used without any negation, the problem does not occur.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
bareos (PTS)	jessie	14.2.1+20141017gitc6c5b56-3+deb8u3	vulnerable
	stretch	16.2.4-3+deb9u2	vulnerable
	buster	16.2.6-5	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
bareos	source	jessie	(unfixed)	end-of-life
bareos	source	(unstable)	(unfixed)

Notes

https://github.com/bareos/bareos/security/advisories/GHSA-jfww-q346-r2r8
https://github.com/bareos/bareos/pull/1875
Fixed by (merge commit): https://github.com/bareos/bareos/commit/2a026698b87d13bd1c6275726b5e826702f81dd5