Source: open-iscsi
Version: 2.1.11-6
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 2.1.11-1
Hi,
The following vulnerabilities were published for open-iscsi.
CVE-2026-44943[0]:
| An Improper Limitation of a Pathname to a Restricted Directory
| ('Path Traversal') vulnerability in open-iscsi allows remote MITM
| attackers to create root-owned files outside the database and
| inject lines into the record. This issue affects open-iscsi:
| from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
CVE-2026-44944[1]:
| An Incorrect Authorization vulnerability in open-iscsi
| allows unprivilidged local users to use the isscsiuio control
| socket. This issue affects open-iscsi: from ? through
| 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-44943
https://www.cve.org/CVERecord?id=CVE-2026-44943
[1] https://security-tracker.debian.org/tracker/CVE-2026-44944
https://www.cve.org/CVERecord?id=CVE-2026-44944
[2]
https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
