Bareos 25.1.2, 24.0.12 and 23.1.9: Security Fix Releases

The new Bareos maintenance releases 25.1.2, 24.0.12 and 23.1.9 contain several security fixes for the Bareos Director and the WebUI. We strongly encourage you to update at least your Director and WebUI in a timely manner.

We recommend upgrading to the latest version of your Bareos branch. In case you would like our experts to help with upgrading or other planning regarding your backup strategy or open source in general, please contact us.

Security fixes in all three releases:

Director: fixed an SQL injection and an information disclosure in the restore command (GHSA-m2qm-v5vc-5qwh, GHSA-2p2p-6cfv-wvgm)
Director: fixed a possible SQL injection in the list and llist bconsole commands (GHSA-7xg8-c72r-8749)
Director: fixed a stack buffer overflow when escaping the File Daemon Uname (GHSA-wrg9-8743-vhp2)
WebUI: added mitigations against Cross-Site Request Forgery of administrative actions in the PHP-based WebUI (GHSA-m2rp-8jr9-qvp2)

Important:
No new packages for FreeBSD 13 will be provided, as the system has reached its end of life

Before you update!
If you run the Bareos WebUI behind a reverse proxy, you now need to configure the trusted_proxies setting in the WebUI configuration.

Additional changes in Bareos 25.1.2 and 24.0.12

Fixed truncation on volume purging
Fixed automatic catalog self-healing on volume mismatches
Addressed a problem in the way the Python API is used

Additional changes in Bareos 25.1.2 only

Fixed a possible Director crash when canceling a duplicate job
Fixed a possible Director crash during a configuration reload
Debian: added missing data from /etc/postgresql to the plugins
Packages for FreeBSD 15 are now provided
Updated the Vue dependencies of the new WebUI

Downloads and changelogs

Bareos 25.1.2: download | changelog
Bareos 24.0.12: download | changelog
Bareos 23.1.9: download | changelog

Security fixes in all three releases:

We recommend upgrading to the latest maintenance release available for your Bareos branch.