What’s Vulnerable › Vulnerabilities

CVE-2022-2787: stricter rules on chroot names

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-27 · updated 2026-06-17
• Weakness: CWE-281

Description

Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.

Affected products

• Debian Linux: 10.0, 11.0
• Debian schroot: before 1.6.13 — fixed in 1.6.13

How to fix

Upgrade to a fixed version: Debian schroot 1.6.13. Check the vendor advisory for mitigations.

References

• https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d
• https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html
• https://lists.debian.org/debian-security-announce/2022/msg00182.html
• https://security.gentoo.org/glsa/202210-11
• https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d
• https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html
• https://lists.debian.org/debian-security-announce/2022/msg00182.html
• https://security.gentoo.org/glsa/202210-11

Get alerted when CVE-2022-2787 or the next vulnerability affects your stack