{"id":"CVE-2020-17437","aliases":["DEBIAN-CVE-2020-17437","EUVD-2020-9390","GHSA-cfgh-w4j7-hfhp","OESA-2022-1757","SUSE-RU-2021:1517-1","SUSE-SU-2021:0663-1","SUSE-SU-2021:1164-1","SUSE-SU-2022:2806-1","SUSE-SU-2022:2861-1","UBUNTU-CVE-2020-17437","USN-6259-1","openSUSE-SU-2024:11112-1"],"status":"published","title":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent...","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02862,"percentile":0.8686,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2020-12-01T00:00:00Z","modified":"2026-10-26T12:00:58Z","fixes":[{"ecosystem":"Debian:12","package":"open-iscsi","fixed_in":["2.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"open-iscsi","fixed_in":["2.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"open-iscsi","fixed_in":["2.1.3-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"Open-iSCSI","fixed_in":["open-iscsi-2.1.1-11.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"open-iscsi","fixed_in":["2.0.873-46.17.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"open-iscsi","fixed_in":["2.0.873+git0.3b4b4500-14ubuntu3.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"open-iscsi","fixed_in":["2.0.874-5ubuntu2.11+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"open-iscsi","fixed_in":["2.0.874-7.1ubuntu6.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"Open-iSCSI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"open-iscsi-2.1.1-11.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-22.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-22.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-12.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP2","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP3","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-13.42.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.876-53.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.873-46.17.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.873+git0.3b4b4500-14ubuntu3.7+esm1"}]}],"versions":["2.0.873-3ubuntu13","2.0.873+git0.3b4b4500-13ubuntu3","2.0.873+git0.3b4b4500-14ubuntu1","2.0.873+git0.3b4b4500-14ubuntu3","2.0.873+git0.3b4b4500-14ubuntu3.1","2.0.873+git0.3b4b4500-14ubuntu3.2","2.0.873+git0.3b4b4500-14ubuntu3.3","2.0.873+git0.3b4b4500-14ubuntu3.4","2.0.873+git0.3b4b4500-14ubuntu3.5","2.0.873+git0.3b4b4500-14ubuntu3.6","2.0.873+git0.3b4b4500-14ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.874-5ubuntu2.11+esm1"}]}],"versions":["2.0.874-4ubuntu3","2.0.874-4ubuntu4","2.0.874-4ubuntu5","2.0.874-5ubuntu1","2.0.874-5ubuntu2","2.0.874-5ubuntu2.1","2.0.874-5ubuntu2.2","2.0.874-5ubuntu2.3","2.0.874-5ubuntu2.4","2.0.874-5ubuntu2.6","2.0.874-5ubuntu2.7","2.0.874-5ubuntu2.9","2.0.874-5ubuntu2.10","2.0.874-5ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.874-7.1ubuntu6.4"}]}],"versions":["2.0.874-7.1ubuntu3","2.0.874-7.1ubuntu5","2.0.874-7.1ubuntu6","2.0.874-7.1ubuntu6.1","2.0.874-7.1ubuntu6.2","2.0.874-7.1ubuntu6.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.873+git0.3b4b4500-14ubuntu3.7+esm1"}]}],"versions":["2.0.873-3ubuntu13","2.0.873+git0.3b4b4500-13ubuntu3","2.0.873+git0.3b4b4500-14ubuntu1","2.0.873+git0.3b4b4500-14ubuntu3","2.0.873+git0.3b4b4500-14ubuntu3.1","2.0.873+git0.3b4b4500-14ubuntu3.2","2.0.873+git0.3b4b4500-14ubuntu3.3","2.0.873+git0.3b4b4500-14ubuntu3.4","2.0.873+git0.3b4b4500-14ubuntu3.5","2.0.873+git0.3b4b4500-14ubuntu3.6","2.0.873+git0.3b4b4500-14ubuntu3.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.874-5ubuntu2.11+esm1"}]}],"versions":["2.0.874-4ubuntu3","2.0.874-4ubuntu4","2.0.874-4ubuntu5","2.0.874-5ubuntu1","2.0.874-5ubuntu2","2.0.874-5ubuntu2.1","2.0.874-5ubuntu2.2","2.0.874-5ubuntu2.3","2.0.874-5ubuntu2.4","2.0.874-5ubuntu2.6","2.0.874-5ubuntu2.7","2.0.874-5ubuntu2.9","2.0.874-5ubuntu2.10","2.0.874-5ubuntu2.11"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.874-7.1ubuntu6.4"}]}],"versions":["2.0.874-7.1ubuntu3","2.0.874-7.1ubuntu5","2.0.874-7.1ubuntu6","2.0.874-7.1ubuntu6.1","2.0.874-7.1ubuntu6.2","2.0.874-7.1ubuntu6.3"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-80.2"}]}],"bundled":2}],"products":[{"vendor":"open-iscsi_project","product":"open-iscsi"},{"vendor":"siemens","product":"sentron_3va_com100_firmware"},{"vendor":"siemens","product":"sentron_3va_com800_firmware"},{"vendor":"siemens","product":"sentron_3va_dsp800_firmware"},{"vendor":"siemens","product":"sentron_pac2200_clp_firmware"},{"vendor":"siemens","product":"sentron_pac2200_firmware"},{"vendor":"siemens","product":"sentron_pac3200_firmware"},{"vendor":"siemens","product":"sentron_pac3200t_firmware"},{"vendor":"siemens","product":"sentron_pac3220_firmware"},{"vendor":"siemens","product":"sentron_pac4200_firmware"},{"vendor":"uip_project","product":"uip"}],"references":[{"url":"https://www.kb.cert.org/vuls/id/815128","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource","advisory"]},{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17437","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cfgh-w4j7-hfhp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-17437","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1757","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2021-1517/suse-ru-20211517-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179908","tags":["report"]},{"url":"https://bugzilla.suse.com/1183421","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17438","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210663-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211164-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173886","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222806-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222861-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1058463","tags":["report"]},{"url":"https://bugzilla.suse.com/1109477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-17437","tags":["report"]},{"url":"https://github.com/open-iscsi/open-iscsi/security/advisories/GHSA-r278-fm99-8rgp","tags":["report"]},{"url":"https://www.forescout.com/company/resources/amnesia33-how-tcp-ip-stacks-breed-critical-vulnerabilities-in-iot-ot-and-it-devices/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6259-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-17437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13988","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-17437","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.","status":"published","published":"2020-12-11T22:24:38Z","modified":"2024-08-04T13:53:17.554Z","updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2020-9390","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.","status":"published","published":"2020-12-11T22:24:38Z","modified":"2024-08-04T13:53:17Z","updated_at":"2026-11-03T03:07:27.538796Z"}],"ghsa":[{"id":"GHSA-cfgh-w4j7-hfhp","title":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent...","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.","status":"published","published":"2022-05-24T17:36:09Z","modified":"2023-01-27T05:03:11Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:42:11.230183Z"}],"nvd":[{"id":"CVE-2020-17437","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.","status":"published","published":"2020-12-11T23:15:12.683Z","modified":"2026-06-17T02:58:55.843Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"CVE-2020-17437","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.","status":"published","published":"2020-12-11T23:15:12.683Z","modified":"2026-10-24T10:30:57.673040807Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-17437","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.","status":"published","published":"2020-12-11T23:15:12.683Z","modified":"2026-10-26T12:00:58.838829428Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"OESA-2022-1757","title":"Open-iSCSI security update","description":"The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.(CVE-2020-17437)","status":"published","published":"2022-07-22T11:05:01Z","modified":"2026-08-18T01:16:46.098537301Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2020-17437","description":"An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.","status":"published","published":"2020-12-01T00:00:00Z","modified":"2026-02-04T03:29:17.58768Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"openSUSE-SU-2024:11112-1","title":"iscsiuio-0.7.8.6-80.2 on GA media","description":"These are all security issues fixed in the iscsiuio-0.7.8.6-80.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:14:42.471555Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-RU-2021:1517-1","title":"Recommended update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\n- Enabled asynchronous logins for iscsi.service (bsc#1183421)\n- Fixed a login issue when target is delayed\n","status":"published","published":"2021-05-05T15:43:58Z","modified":"2026-02-04T03:26:46.090249Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2021:0663-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\nFixes for CVE-2019-17437, CVE-2020-17438, CVE-2020-13987 and CVE-2020-13988 (bsc#1179908):\n\n- check for TCP urgent pointer past end of frame\n- check for u8 overflow when processing TCP options\n- check for header length underflow during checksum calculation\n","status":"published","published":"2021-03-01T15:13:59Z","modified":"2026-02-04T02:29:28.898038Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:1164-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\n- CVE-2020-17437: uIP Out-of-Bounds Write (bsc#1179908)\n- CVE-2020-17438: uIP Out-of-Bounds Write (bsc#1179908)\n- CVE-2020-13987: uIP Out-of-Bounds Read (bsc#1179908)\n- CVE-2020-13988: uIP Integer Overflow (bsc#1179908)\n- Enabled no-wait ('-W') iscsiadm option for iscsi login service (bsc#1173886, bsc#1183421)\n- Added the ability to perform async logins (bsc#1173886)\n","status":"published","published":"2021-04-13T12:02:36Z","modified":"2026-02-04T04:00:32.310744Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2022:2806-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\nFixed various vulnerabilities in the embedded TCP/IP stack (bsc#1179908):\n - CVE-2020-13987: Fixed an out of bounds memory access when\n   calculating the checksums for IP packets.\n - CVE-2020-13988: Fixed an integer overflow when parsing TCP MSS\n   options of IPv4 network packets.\n - CVE-2020-17437: Fixed an out of bounds memory access when the TCP\n   urgent flag is set.\n","status":"published","published":"2022-08-15T08:01:18Z","modified":"2026-02-04T04:33:35.633958Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2861-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\n- CVE-2020-17437: Fixed an out of bounds memory access when the TCP\n  urgent flag is set. (bsc#1179908).\n\nNon-security fixes:\n\n- Fix an issue with ARP booting when using different subnets (bsc#1058463).\n- Allow target discovery using 'db' mode (bsc#1109477).\n","status":"published","published":"2022-08-22T08:15:28Z","modified":"2026-02-04T02:24:44.29914Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-6259-1","title":"open-iscsi vulnerabilities","description":"Jos Wetzels, Stanislav Dashevskyi, and Amine Amri discovered that\nOpen-iSCSI incorrectly handled certain checksums for IP packets.\nAn attacker could possibly use this issue to expose sensitive information.\n(CVE-2020-13987)\n\nJos Wetzels, Stanislav Dashevskyi, Amine Amri discovered that\nOpen-iSCSI incorrectly handled certain parsing TCP MSS options.\nAn attacker could possibly use this issue to cause a crash or cause\nunexpected behavior. (CVE-2020-13988)\n\nAmine Amri and Stanislav Dashevskyi discovered that Open-iSCSI\nincorrectly handled certain TCP data. An attacker could possibly\nuse this issue to expose sensitive information. (CVE-2020-17437)\n","status":"published","published":"2023-07-27T11:00:57Z","modified":"2026-06-25T13:32:13.206650558Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}