CVE-2022-37703: Amanda

Low severity, CVSS 3.3. EPSS: 0.7% chance of exploitation in the next 30 days.

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.

Affected products

• Amanda Amanda: version 3.5.1 only

Published 2022-09-13. Last modified 2026-06-17.