{"id":"CVE-2021-3139","aliases":["DEBIAN-CVE-2021-3139","EUVD-2021-26486","GHSA-j364-gjm2-cwx8","RHSA-2021:1452","RHSA-2021:1518","SUSE-SU-2021:0093-1","SUSE-SU-2021:0143-1","SUSE-SU-2021:0158-1","UBUNTU-CVE-2021-3139","USN-4707-1","openSUSE-SU-2021:0097-1","openSUSE-SU-2021:0128-1"],"status":"published","title":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in...","description":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02681,"percentile":0.86014,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2021-01-13T15:33:45Z","modified":"2026-10-23T18:03:14Z","fixes":[{"ecosystem":"Debian:12","package":"tcmu","fixed_in":["1.5.2-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tcmu","fixed_in":["1.5.2-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tcmu","fixed_in":["1.5.2-6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"tcmu-runner","fixed_in":["1.5.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"tcmu-runner","fixed_in":["1.4.0-4.3.1","1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"tcmu-runner","fixed_in":["1.4.0-3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tcmu","fixed_in":["1.5.2-5ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"tcmu-runner","fixed_in":["1.5.2-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"tcmu-runner","fixed_in":["1.4.0-lp151.3.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-6"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-grafana-dashboards","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-diskprediction-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-k8sevents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-rook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.49.2-1.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libtcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-2.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-2.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-grafana-dashboards","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mds-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-diskprediction-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-k8sevents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-rook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-osd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-radosgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"gperftools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"gperftools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"gperftools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"gperftools-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libcephfs2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libradosstriper1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librbd1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librgw2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-cephfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rados-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-nbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.49.2-1.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libtcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.56-1.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"cephmetrics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-1.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"cephmetrics-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-1.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.4-3.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-139.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0-3.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"tcmu-runner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0-3.el7cp"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-3.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-5ubuntu0.20.04.1"}]}],"versions":["1.4.0-1","1.5.2-2","1.5.2-2ubuntu1","1.5.2-3","1.5.2-4","1.5.2-5","1.5.2-5build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-6","1.5.4-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-4.1","1.5.4-5","1.5.4-6ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-10"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-9","1.5.4-10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-5ubuntu0.20.04.1"}]}],"versions":["1.4.0-1","1.5.2-2","1.5.2-2ubuntu1","1.5.2-3","1.5.2-4","1.5.2-5","1.5.2-5build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-lp151.3.9.1"}]}]}],"products":[{"vendor":"tcmu-runner_project","product":"tcmu-runner"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1178372","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugzilla.suse.com/attachment.cgi?id=844938","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/01/12/12","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/13/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Mitigation","Third Party Advisory","advisory"]},{"url":"https://github.com/open-iscsi/tcmu-runner/pull/644","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3139","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j364-gjm2-cwx8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3139","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1452","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1831779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1831798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1859257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1867717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1873881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1875346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1875777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1876827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1882561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1888630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1903990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1908910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1909176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912538","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1916045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919294","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925651","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1929064","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1929714","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930164","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931365","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1932175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1932780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1932848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1933963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1936210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1936647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949166","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1452.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-25678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25678","tags":["advisory"]},{"url":"https://tracker.ceph.com/issues/37503","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3139","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3139","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1518","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1650209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1652233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1827262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1832372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1842390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1871035","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1876551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1882724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1887661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1894426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896392","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1900109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906293","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947072","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1948050","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1518.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12059","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12059","tags":["advisory"]},{"url":"https://ceph.io/releases/v13-2-10-mimic-released/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13379","tags":["advisory"]},{"url":"https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2020/06/09/2/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-27781","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27781","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27781","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210093-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180676","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3139","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210143-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1138443","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210158-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3139","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/01/13/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4707-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PTFH53IA4W7XVWYIQM4NLLAGVV2F4GXC/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JYQLRIH544YEAMHU4GAXRYAFN2OW7FVX/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3139","description":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.","status":"published","published":"2021-01-13T15:33:45Z","modified":"2024-08-03T16:45:51.388Z","updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-26486","description":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.","status":"published","published":"2021-01-13T15:33:45Z","modified":"2024-08-03T16:45:51Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-j364-gjm2-cwx8","title":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in...","description":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.","status":"published","published":"2022-05-24T17:39:14Z","modified":"2023-01-29T05:06:08Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:45:57.128816Z"}],"nvd":[{"id":"CVE-2021-3139","description":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.","status":"published","published":"2021-01-13T16:15:14.617Z","modified":"2026-06-17T04:04:44.14Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:49.284888Z"}],"osv":[{"id":"CVE-2021-3139","description":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.","status":"published","published":"2021-01-13T16:15:14.617Z","modified":"2026-10-20T10:54:39.919397748Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-3139","description":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.","status":"published","published":"2021-01-13T16:15:14.617Z","modified":"2026-10-23T18:03:14.019298721Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"RHSA-2021:1452","title":"Red Hat Security Advisory: Red Hat Ceph Storage security, bug fix, and enhancement Update","status":"published","published":"2024-09-16T05:20:42Z","modified":"2026-06-28T10:43:40Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:1518","title":"Red Hat Security Advisory: Red Hat Ceph Storage 3.3 Security and Bug Fix Update","status":"published","published":"2024-09-13T22:13:48Z","modified":"2026-08-08T10:01:53Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2021-3139","description":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.","status":"published","published":"2021-01-13T16:15:00Z","modified":"2026-10-17T12:55:45.645962667Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"openSUSE-SU-2021:0097-1","title":"Security update for tcmu-runner","description":"This update for tcmu-runner fixes the following issues:\n\n- CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-01-17T09:28:21Z","modified":"2026-02-04T03:33:51.452254Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0128-1","title":"Security update for tcmu-runner","description":"This update for tcmu-runner fixes the following issue:\n\n- CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-20T15:22:46Z","modified":"2026-02-04T03:16:28.42773Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"SUSE-SU-2021:0093-1","title":"Security update for tcmu-runner","description":"This update for tcmu-runner fixes the following issues:\n\n- CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).\n","status":"published","published":"2021-01-13T15:45:45Z","modified":"2026-02-04T03:13:53.756449Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0143-1","title":"Security update for tcmu-runner","description":"This update for tcmu-runner fixes the following issue:\n\n- CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).\n","status":"published","published":"2021-01-15T15:14:02Z","modified":"2026-02-04T03:05:08.822818Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0158-1","title":"Security update for tcmu-runner","description":"This update for tcmu-runner fixes the following issue:\n\n- CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).\n","status":"published","published":"2021-01-18T10:57:41Z","modified":"2026-02-04T04:25:26.64751Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-4707-1","title":"tcmu vulnerability","description":"It was discovered that TCMU lacked a check for transport-layer restrictions,\nallowing remote attackers to read or write files via directory traversal in\nan XCOPY request.\n","status":"published","published":"2021-01-28T13:41:59Z","modified":"2026-04-27T15:48:50.40376Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}