Critical Vulnerability in BorgBackup: Potential for Backup Data Loss
Summary
DEBIAN-CVE-2023-36811: borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Affects borgbackup versions < 1.2.5-1. Fixed in 1.2.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BorgBackup is an open-source, deduplicating archiver that provides features such as compression and authenticated encryption. It is designed to efficiently back up data while ensuring that the backups are secure and reliable. However, a recent vulnerability has been identified that compromises the integrity of the backup archives, allowing unauthorized manipulation of the backup data.
Vulnerability Detail
A flaw in the cryptographic authentication scheme of BorgBackup allows an attacker with write access to the repository to insert files into backups without proper headers. This could lead to the creation of fake archives, potentially resulting in backup data loss. The vulnerability does not expose plaintext data to the attacker nor does it affect the authenticity of existing archives. The risk is higher for smaller or empty archives, while larger archives are less likely to be affected.
How To Fix
Minimum fixed version
1.2.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade borgbackupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. However, users can mitigate potential data loss by reviewing the archives (checking timestamps and contents) after running 'borg check --repair' and before executing 'borg prune'.
Conclusion
The vulnerability in BorgBackup poses a significant risk to data integrity by allowing unauthorized manipulation of backup archives. Users are strongly advised to upgrade to the patched version 1.2.5-1 and follow the recommended procedures to safeguard their data. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for borgbackup →
FAQ
The vulnerability allows an attacker with write access to the repository to insert files into backups, potentially creating fake archives.
If you are using a version prior to 1.2.5-1, your installation is vulnerable and should be updated immediately.
The primary risk is the potential for backup data loss due to the creation of fake archives, which could mislead users about the integrity of their backups.
Existing archives remain authentic, but users should verify their contents and timestamps to ensure no manipulation has occurred.
You can use Vulert, which monitors open-source vulnerabilities in real-time using a manifest file like package-lock.json. Check your application against known vulnerabilities using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for borgbackup.
