{"id":"CVE-2018-16949","aliases":["DEBIAN-CVE-2018-16949","DLA-1513-1","DSA-4302-1","EUVD-2018-8737","GHSA-2x26-cf8j-qvpf","MGASA-2019-0021","UBUNTU-CVE-2018-16949","openSUSE-SU-2024:11113-1"],"status":"published","title":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used...","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03075,"percentile":0.87753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2018-09-12T01:00:00Z","modified":"2026-10-23T18:03:28Z","fixes":[{"ecosystem":"Debian:12","package":"openafs","fixed_in":["1.8.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openafs","fixed_in":["1.8.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-2+deb8u8"}]}],"versions":["1.6.9-2+deb8u2","1.6.9-2+deb8u3","1.6.9-2+deb8u4","1.6.9-2+deb8u4~bpo70+1","1.6.9-2+deb8u5","1.6.9-2+deb8u6","1.6.9-2+deb8u7"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-2+deb9u2"}]}],"versions":["1.6.20-2","1.6.20-2+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.23-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.14-1","1.6.15-1","1.6.15-1ubuntu1","1.6.15-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.21-3","1.6.21-3ubuntu1","1.6.22-3","1.8.0~pre4-1","1.8.0~pre5-1","1.8.0~pre5-1ubuntu1","1.8.0~pre5-1ubuntu1.1","1.8.0~pre5-1ubuntu1.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1.13"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openafs","product":"openafs"}],"references":[{"url":"http://www.securityfocus.com/bid/106375","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://openafs.org/pages/security/OPENAFS-SA-2018-003.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2018/dsa-4302","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16949"},{"url":"https://github.com/advisories/GHSA-2x26-cf8j-qvpf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16949","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0021.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23663","tags":["report"]},{"url":"https://openafs.org/pages/security/OPENAFS-SA-2018-001.txt","tags":["web"]},{"url":"https://openafs.org/pages/security/OPENAFS-SA-2018-002.txt","tags":["web"]},{"url":"https://openafs.org/pages/security/OPENAFS-SA-2018-003.txt","tags":["web"]},{"url":"http://openafs.org/dl/openafs/1.6.23/RELNOTES-1.6.23","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-16949","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16949","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16949","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-16949","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.","status":"published","published":"2018-09-12T01:00:00Z","modified":"2024-08-05T10:39:58.049Z","updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-8737","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.","status":"published","published":"2018-09-12T01:00:00Z","modified":"2024-08-05T10:39:58Z","updated_at":"2026-11-03T02:39:39.763591Z"}],"ghsa":[{"id":"GHSA-2x26-cf8j-qvpf","title":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used...","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.","status":"published","published":"2022-05-14T01:28:01Z","modified":"2023-02-02T05:03:48Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:51:42.915943Z"}],"nvd":[{"id":"CVE-2018-16949","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.","status":"published","published":"2018-09-12T01:29:00.623Z","modified":"2026-06-17T01:45:06.55Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:38.672108Z"}],"osv":[{"id":"CVE-2018-16949","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.","status":"published","published":"2018-09-12T01:29:00.623Z","modified":"2026-04-16T06:18:46.210044389Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16949","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.","status":"published","published":"2018-09-12T01:29:00.623Z","modified":"2026-10-23T18:03:28.722754773Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-16949","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.","status":"published","published":"2018-09-12T01:29:00Z","modified":"2026-04-22T11:48:14.713873Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1513-1","title":"openafs - security update","status":"published","published":"2018-09-21T00:00:00Z","modified":"2026-03-09T01:19:22.984385Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4302-1","title":"openafs - security update","status":"published","published":"2018-09-23T00:00:00Z","modified":"2026-03-09T02:10:12.724144Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0021","title":"Updated openafs packages fix security vulnerabilities","description":"Jeffrey Altman reported that the backup tape controller (butc) process\ndoes accept incoming RPCs but does not require (or allow for)\nauthentication of those RPCs, allowing an unauthenticated attacker to\nperform volume operations with administrator credentials\n(CVE-2018-16947).\n\nMark Vitale reported that several RPC server routines do not fully\ninitialize output variables, leaking memory contents (from both the\nstack and the heap) to the remote caller for otherwise-successful RPCs\n(CVE-2018-16948).\n\nMark Vitale reported that an unauthenticated attacker can consume large\namounts of server memory and network bandwidth via specially crafted\nrequests, resulting in denial of service to legitimate clients\n(CVE-2018-16949).\n","status":"published","published":"2019-01-08T21:50:23Z","modified":"2026-04-16T06:25:47.436540473Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11113-1","title":"openafs-1.8.8-1.13 on GA media","description":"These are all security issues fixed in the openafs-1.8.8-1.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:45.00846Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}