{"action":"Upgrade openafs to 1.8.2-1 or later.","affected":[{"fixed":"1.8.2-1","introduced":"0"}],"component":"openafs","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.8.2-1"],"id":"tcs_01M5ND5JY2HRD774AZPJAX56GT","modified_at":"2026-10-23T18:03:28.648271390Z","published_at":"2018-09-12T01:29:00.390Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2018-16947","https://security-tracker.debian.org/tracker/CVE-2018-16947"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2018-16947#Debian:13/openafs","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2018-16947"}],"summary":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPC"}