Debian alert DLA-4813-1 (open-iscsi)

From:
             
 
Daniel Leidert <dleidert@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4813-1] open-iscsi security update
Date:
             
 
Fri, 02 Oct 2026 08:44:40 +0200
Message-ID:
             
 
<1540e31bb360c78db20564c799676e1a458d4a66.camel@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4813-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Daniel Leidert
October 02, 2026                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : open-iscsi
Version        : 2.1.8-1+deb12u1
CVE ID         : CVE-2026-18724 CVE-2026-18725 CVE-2026-18726 CVE-2026-18727 
                 CVE-2026-18728 CVE-2026-44943 CVE-2026-44944
Debian Bug     : 1143059 1144935

Multiple vulnerabilities were found in open-iscsi, a high-performance,
transport independent, multi-platform implementation of RFC3720 iSCSI.

CVE-2026-18724

   A stack buffer overflow exists in idbm_recinfo_config.

CVE-2026-18725

   An out-of-bounds access exists in the IPv6 ICMPv6 echo handling.

CVE-2026-18726

   Multiple vulnerabilities exist in the ICMPv6 Router Advertisement
   option parsing.

CVE-2026-18727

   An integer underflow exists in the iscsiuio DHCPv6 parsing.

CVE-2026-18728

   An integer underflow exists in the iscsiuio IPv4 DHCP parsing.

CVE-2026-44943

   Improve iscsid discovery handling of IQN names.

CVE-2026-44944

   An unprivilidged local user can use the isscsiuio control socket.

For Debian 12 bookworm, these problems have been fixed in version
2.1.8-1+deb12u1.

We recommend that you upgrade your open-iscsi packages.

For the detailed security status of open-iscsi please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/open-iscsi

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQJIBAABCgAyFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmq/UtgUHGRsZWlkZXJ0
QGRlYmlhbi5vcmcACgkQS80FZ8KW0F3ZkQ/6AjBjnwaKn3IVgLOELU270iSq/XVn
c9tcwBZf09bedBl+lzQ1Y8oHK6vrv0ACI9qTs5WnneekhtIH3/r6r6+Mh2AeEOq8
aD/n6YSljSUUSxUBzLyEEzo6eXY9W+rwddov0k1wrIFa9J9musjeG7+rQWq3Z6bF
1BqEfPtlArVEP877gWsHOmUsv56/tknGdXbVVcSYSECnmzCywL0672fevooL5ulf
960R1x8JaTW8VtduT91XjGeMK+R/ymns6bdhzeJfobGuabR+IDX11dU4F5WqhoN0
VuYdpyRgzw45/jfPgUAfQeGpmlZgyPXsXfK4sKPKHPRxhz6AItT+4vQvKB8kRFOQ
5EsrtkgYkJ1yOxPx5MX+dVaO0L3zPAZgExWXIR32N9ZlAoPZWvXE+eXeUErBuS0r
kqN/wTtFS9CyPOHJcOV2TIMiikhEVmU6z9/7VTK7m26y4bcVwDo/1C5N7SLKzj8y
GwAA56Na7F5MO/n2qaYVcCS3+DMRpa5TYy4WHfNGhRH0q2EFWp3S1uPjEl82OdRV
sDtgxM9SB9KyrKI5X0RG28eOXdYqRfrUz6s/k7ugZSNsfD1Yre7zpO3ehNWVVNPV
+aMF4Qic0KdF5JAM4/4K1KUeqLlV1KUxZUMBBL1WHWH47eoKn6UgHvcxC2Galeex
Ii2313xTBgWjD+Y=
=WIaY
-----END PGP SIGNATURE-----