{"id":"SUSE-SU-2026:23157-1","summary":"Security update for open-iscsi","details":"This update for open-iscsi fixes the following issues:\n\nUpdate to version 2.1.12.suse+0.8f77cf16:\n\n- CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create\n  root-owned files outside the database and inject lines into records (bsc#1268353).\n- CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the `isscsiuio` control socket\n  (bsc#1268352).\n\nChanges for open-iscsi:\n\n- Version 2.1.12.suse+0.8f77cf16:\n  * Fix security issues recently discovered by Keith at Linneman Labs.\n  * iscsi-init.service: use `iscsi-gen-initiatorname`.\n  * iscsi-gen-initiatorname: use `@IQN_PREFIX@` as default.\n  * Avoid possible double free of found in `idbm_rec_update_param`.\n  * iscsi: validate interface IP against target address family.\n","modified":"2026-08-18T18:23:49.853962721Z","published":"2026-08-14T06:41:21Z","related":["CVE-2026-44943","CVE-2026-44944"],"upstream":["CVE-2026-44943","CVE-2026-44944"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623157-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268352"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268353"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-44943"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-44944"}],"affected":[{"package":{"name":"open-iscsi","ecosystem":"SUSE:Linux Micro 6.2","purl":"pkg:rpm/suse/open-iscsi&distro=SUSE%20Linux%20Micro%206.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-160000.4.1"}]}],"ecosystem_specific":{"binaries":[{"libopeniscsiusr0":"0.2.0-160000.4.1","open-iscsi":"2.1.12-160000.4.1","iscsiuio":"0.7.8.8-160000.4.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23157-1.json"}}],"schema_version":"1.9.0"}