openSUSE-SU-2021:0089-1

Security update for open-iscsi

No scoreFix available

openSUSE-SU-2021:0089-1 is a vulnerability with no CVSS score yet in open-iscsi, published January 16, 2021. No source lists public exploit code. Fixed in open-iscsi 2.1.3-lp152.18.6.1.

What does this mean?

Severity: UnratedNo CVSS score yet
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 2.1.3-lp152.18.6.1open-iscsi

Description

This update for open-iscsi fixes the following issues:

Updated to upstream version 2.1.3 as 2.1.3-suse, for bsc#1179908, including:
- uip: check for TCP urgent pointer past end of frame
- uip: check for u8 overflow when processing TCP options
- uip: check for header length underflow during checksum calculation
- fwparam_ppc: Fix memory leak in fwparam_ppc.c
- iscsiuio: Remove unused macro IFNAMSIZ defined in iscsid_ipc.c
- fwparam_ppc: Fix illegal memory access in fwparam_ppc.c
- sysfs: Verify parameter of sysfs_device_get()
- fwparam_ppc: Fix NULL pointer dereference in find_devtree()
- open-iscsi: Clean user_param list when process exit
- iscsi_net_util: Fix NULL pointer dereference in find_vlan_dev()
- open-iscsi: Fix NULL pointer dereference in mgmt_ipc_read_req()
- open-iscsi: Fix invalid pointer deference in find_initiator()
- iscsiuio: Fix invalid parameter when call fstat()
- iscsi-iname: Verify open() return value before calling read()
- iscsi_sysfs: Fix NULL pointer deference in iscsi_sysfs_read_iface
Updatged to latest upstream, including:
- iscsiadm: Optimize the the verification of mode paramters
- iscsid: Poll timeout value to 1 minute for iscsid
- iscsiadm: fix host stats mode coredump
- iscsid: fix logging level when starting and shutting down daemon
- Updated iscsiadm man page.
- Fix memory leak in sysfs_get_str
- libopeniscsiusr: Compare with max int instead of max long
Systemd unit files should not depend on network.target (bsc#1179440).
Updated to latest upstream, including async login ability:

Implement login 'no_wait' for iscsiadm NODE mode
iscsiadm buffer overflow regression when discovering many targets at once
iscsid: Check Invalid Session id for stop connection
Add ability to attempt target logins asynchronously

%service_del_postun_without_restart is now available on SLE More accurately it's been introduced in SLE12-SP2+ and SLE15+

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Affected packages

Affected packages
Package	Affected	Fixed
`open-iscsi` openSUSE:Leap 15.2	before 2.1.3-lp152.18.6.1	2.1.3-lp152.18.6.1

What each source reports

OSVNo score

Security update for open-iscsi

This update for open-iscsi fixes the following issues:

Updated to upstream version 2.1.3 as 2.1.3-suse, for bsc#1179908, including:
- uip: check for TCP urgent pointer past end of frame
- uip: check for u8 overflow when processing TCP options
- uip: check for header length underflow during checksum calculation
- fwparam_ppc: Fix memory leak in fwparam_ppc.c
- iscsiuio: Remove unused macro IFNAMSIZ defined in iscsid_ipc.c
- fwparam_ppc: Fix illegal memory access in fwparam_ppc.c
- sysfs: Verify parameter of sysfs_device_get()
- fwparam_ppc: Fix NULL pointer dereference in find_devtree()
- open-iscsi: Clean user_param list when process exit
- iscsi_net_util: Fix NULL pointer dereference in find_vlan_dev()
- open-iscsi: Fix NULL pointer dereference in mgmt_ipc_read_req()
- open-iscsi: Fix invalid pointer deference in find_initiator()
- iscsiuio: Fix invalid parameter when call fstat()
- iscsi-iname: Verify open() return value before calling read()
- iscsi_sysfs: Fix NULL pointer deference in iscsi_sysfs_read_iface
Updatged to latest upstream, including:
- iscsiadm: Optimize the the verification of mode paramters
- iscsid: Poll timeout value to 1 minute for iscsid
- iscsiadm: fix host stats mode coredump
- iscsid: fix logging level when starting and shutting down daemon
- Updated iscsiadm man page.
- Fix memory leak in sysfs_get_str
- libopeniscsiusr: Compare with max int instead of max long
Systemd unit files should not depend on network.target (bsc#1179440).
Updated to latest upstream, including async login ability:

Implement login 'no_wait' for iscsiadm NODE mode
iscsiadm buffer overflow regression when discovering many targets at once
iscsid: Check Invalid Session id for stop connection
Add ability to attempt target logins asynchronously

%service_del_postun_without_restart is now available on SLE More accurately it's been introduced in SLE12-SP2+ and SLE15+

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record: openSUSE-SU-2021:0089-1
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

Description

Affected packages

What each source reports

History

References