{"id":"openSUSE-SU-2026:21580-1","summary":"Security update for open-iscsi","details":"This update for open-iscsi fixes the following issues:\n\nUpdate to version 2.1.12.suse+0.8f77cf16:\n\n- CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create\n  root-owned files outside the database and inject lines into records (bsc#1268353).\n- CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the `isscsiuio` control socket\n  (bsc#1268352).\n\nChanges for open-iscsi:\n\n- Version 2.1.12.suse+0.8f77cf16:\n  * Fix security issues recently discovered by Keith at Linneman Labs.\n  * iscsi-init.service: use `iscsi-gen-initiatorname`.\n  * iscsi-gen-initiatorname: use `@IQN_PREFIX@` as default.\n  * Avoid possible double free of found in `idbm_rec_update_param`.\n  * iscsi: validate interface IP against target address family.\n","modified":"2026-08-16T18:23:49.120043002Z","published":"2026-08-14T06:41:35Z","related":["CVE-2026-44943","CVE-2026-44944"],"upstream":["CVE-2026-44943","CVE-2026-44944"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268352"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268353"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-44943"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-44944"}],"affected":[{"package":{"name":"open-iscsi","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/open-iscsi&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-160000.4.1"}]}],"ecosystem_specific":{"binaries":[{"libopeniscsiusr0":"0.2.0-160000.4.1","open-iscsi":"2.1.12-160000.4.1","open-iscsi-devel":"2.1.12-160000.4.1","iscsiuio":"0.7.8.8-160000.4.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21580-1.json"}}],"schema_version":"1.9.0"}