borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as documented in the change log. Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any "borg check --repair" and before "borg prune". There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw     in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and     potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be     able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the     repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the     authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small     archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are     advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as     documented in the change log. Data loss after being attacked can be avoided by reviewing the archives     (timestamp and contents valid and as expected) after any borg check --repair and before borg prune.
    There are no known workarounds for this vulnerability. (CVE-2023-36811)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-467632ecbe advisory.

    fix for CVE-2023-36811: spoofed archive leads to data loss

    Please note that starting with borgbackup 1.2.5 all borg repos must use TAM authentication:
    https://github.com/borgbackup/borg/blob/1.2.6/docs/changes.rst#pre-125-archives-spoofing-vulnerability-     cve-2023-36811

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-34411d8f77 advisory.

    fix for CVE-2023-36811: spoofed archive leads to data loss

    Please note that starting with borgbackup 1.2.5 all borg repos must use TAM authentication:
    https://github.com/borgbackup/borg/blob/1.2.6/docs/changes.rst#pre-125-archives-spoofing-vulnerability-     cve-2023-36811

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-555f9fac30 advisory.

    fix for CVE-2023-36811: spoofed archive leads to data loss

    Please note that starting with borgbackup 1.2.5 all borg repos must use TAM authentication:
    https://github.com/borgbackup/borg/blob/1.2.6/docs/changes.rst#pre-125-archives-spoofing-vulnerability-     cve-2023-36811

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b8a52e5a-483d-11ee-971d-3df00e0f9020 advisory.

  - borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw     in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and     potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be     able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the     repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the     authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small     archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are     advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as     documented in the change log. Data loss after being attacked can be avoided by reviewing the archives     (timestamp and contents valid and as expected) after any borg check --repair and before borg prune.
    There are no known workarounds for this vulnerability. (CVE-2023-36811)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
227423	Linux Distros Unpatched Vulnerability : CVE-2023-36811	Nessus	Misc.	medium
185214	Fedora 39 : borgbackup (2023-467632ecbe)	Nessus	Fedora Local Security Checks	medium
181461	Fedora 37 : borgbackup (2023-34411d8f77)	Nessus	Fedora Local Security Checks	medium
181458	Fedora 38 : borgbackup (2023-555f9fac30)	Nessus	Fedora Local Security Checks	medium
180430	FreeBSD : Borg (Backup) -- flaw in cryptographic authentication scheme in Borg allowed an attacker to fake archives and indirectly cause backup data loss. (b8a52e5a-483d-11ee-971d-3df00e0f9020)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2023-36811

medium

Tenable Plugins

medium

medium

medium

medium

medium