{"id":"CVE-2022-2787","aliases":["DEBIAN-CVE-2022-2787","DLA-3075-1","DSA-5213-1","EUVD-2022-35028","GHSA-pmr6-f78j-pq2c","MGASA-2022-0329","UBUNTU-CVE-2022-2787","USN-5584-1"],"status":"published","title":"stricter rules on chroot names","description":"Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01044,"percentile":0.64346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-281"],"published":"2022-08-15T00:00:00Z","modified":"2026-10-15T08:02:28Z","fixes":[{"ecosystem":"Debian:12","package":"schroot","fixed_in":["1.6.12-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"schroot","fixed_in":["1.6.12-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"schroot","fixed_in":["1.6.12-2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"schroot","fixed_in":["1.6.10-6+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"schroot","fixed_in":["1.6.10-12+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"schroot","fixed_in":["1.7.2-18.1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"schroot","fixed_in":["1.6.10-1ubuntu3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"schroot","fixed_in":["1.6.10-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"schroot","fixed_in":["1.6.10-9ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"schroot","fixed_in":["1.6.10-12ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-6+deb10u1"}]}],"versions":["1.6.10-6"]},{"source":"osv","ecosystem":"Debian:11","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-12+deb11u1"}]}],"versions":["1.6.10-12"]},{"source":"osv","ecosystem":"Mageia:8","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-18.1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-1ubuntu3+esm1"}]}],"versions":["1.6.10-1ubuntu2","1.6.10-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-4ubuntu0.1"}]}],"versions":["1.6.10-4","1.6.10-4build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-9ubuntu0.1"}]}],"versions":["1.6.10-6","1.6.10-8","1.6.10-9","1.6.10-9build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-12ubuntu3.1"}]}],"versions":["1.6.10-12ubuntu2","1.6.10-12ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-1ubuntu3+esm1"}]}],"versions":["1.6.10-1ubuntu2","1.6.10-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-4ubuntu0.1"}]}],"versions":["1.6.10-4","1.6.10-4build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-9ubuntu0.1"}]}],"versions":["1.6.10-6","1.6.10-8","1.6.10-9","1.6.10-9build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"schroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-12ubuntu3.1"}]}],"versions":["1.6.10-12ubuntu2","1.6.10-12ubuntu3"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"debian","product":"schroot"}],"references":[{"url":"https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-security-announce/2022/msg00182.html","tags":["x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html","tags":["x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202210-11","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2787"},{"url":"https://github.com/advisories/GHSA-pmr6-f78j-pq2c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2787","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0329.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30758","tags":["report"]},{"url":"https://www.debian.org/security/2022/dsa-5213","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-2787","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5584-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2787","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-2787","title":"stricter rules on chroot names","description":"Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.","status":"published","published":"2022-08-27T11:30:20.934Z","modified":"2024-09-16T19:51:44.215Z","updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-35028","description":"Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.","status":"published","published":"2022-08-27T11:30:20Z","modified":"2024-09-16T19:51:44Z","updated_at":"2026-11-03T00:55:19.119653Z"}],"ghsa":[{"id":"GHSA-pmr6-f78j-pq2c","title":"Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of...","description":"Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.","status":"published","published":"2022-08-28T00:00:26Z","modified":"2023-01-30T05:02:55Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:46:44.594683Z"}],"nvd":[{"id":"CVE-2022-2787","description":"Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.","status":"published","published":"2022-08-27T12:15:08.243Z","modified":"2026-06-17T04:42:34.797Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:07:25.883929Z"}],"osv":[{"id":"CVE-2022-2787","description":"Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.","status":"published","published":"2022-08-27T12:15:08.243Z","modified":"2026-04-16T04:41:04.169628129Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-2787","description":"Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.","status":"published","published":"2022-08-27T12:15:08.243Z","modified":"2026-11-03T08:01:11.220124323Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"UBUNTU-CVE-2022-2787","description":"Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.","status":"published","published":"2022-08-15T00:00:00Z","modified":"2026-04-22T13:21:01.910324Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"DLA-3075-1","title":"schroot - security update","status":"published","published":"2022-08-18T00:00:00Z","modified":"2026-03-09T01:22:28.874681Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5213-1","title":"schroot - security update","status":"published","published":"2022-08-18T00:00:00Z","modified":"2026-03-09T02:10:36.46595Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0329","title":"Updated schroot packages fix security vulnerability","description":"Schroot before 1.6.13 had too permissive rules on chroot or session names,\nallowing a denial of service on the schroot service for all users that may\nstart a schroot session. (CVE-2022-2787)\n","status":"published","published":"2022-09-16T19:39:55Z","modified":"2026-04-16T04:44:44.517512964Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-5584-1","title":"schroot vulnerability","description":"It was discovered that Schroot incorrectly handled certain Schroot names.\nAn attacker could possibly use this issue to break schroot's internal\nstate causing a denial of service.\n","status":"published","published":"2022-08-29T10:12:41Z","modified":"2026-06-25T13:31:20.827603649Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}