{"answers":{"affected":"","exploited":"There is no known exploitation of openSUSE-SU-2021:0089-1 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"openSUSE-SU-2021:0089-1 is a memory corruption vulnerability in open-iscsi, published on 16 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for openSUSE-SU-2021:0089-1 and fix it if it is affected.\n\nWhat it is: openSUSE-SU-2021:0089-1 is a memory corruption vulnerability in open-iscsi, published on 16 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of openSUSE-SU-2021:0089-1 in the wild and no public exploit code.\n\nAffected product: open-iscsi. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/openSUSE-SU-2021-0089-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2021-0089-1/index.md)","id":"openSUSE-SU-2021:0089-1","markdown":"https://insights.sbomify.com/openSUSE-SU-2021-0089-1/index.md","name":"openSUSE-SU-2021:0089-1","record":{"aliases":[],"analysis":{"component_type":"operating_system","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"openSUSE iSCSI initiator","requires_auth":"none","summary":"Multiple memory corruption and NULL pointer dereference flaws in open-iscsi allow remote attackers to execute arbitrary code or cause denial of service.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"This update for open-iscsi fixes the following issues:\n\n- Updated to upstream version 2.1.3 as 2.1.3-suse, for bsc#1179908,\n  including:\n  * uip: check for TCP urgent pointer past end of frame\n  * uip: check for u8 overflow when processing TCP options\n  * uip: check for header length underflow during checksum calculation\n  * fwparam_ppc: Fix memory leak in fwparam_ppc.c\n  * iscsiuio: Remove unused macro IFNAMSIZ defined in iscsid_ipc.c\n  * fwparam_ppc: Fix illegal memory access in fwparam_ppc.c\n  * sysfs: Verify parameter of sysfs_device_get()\n  * fwparam_ppc: Fix NULL pointer dereference in find_devtree()\n  * open-iscsi: Clean user_param list when process exit\n  * iscsi_net_util: Fix NULL pointer dereference in find_vlan_dev()\n  * open-iscsi: Fix NULL pointer dereference in mgmt_ipc_read_req()\n  * open-iscsi: Fix invalid pointer deference in find_initiator()\n  * iscsiuio: Fix invalid parameter when call fstat()\n  * iscsi-iname: Verify open() return value before calling read()\n  * iscsi_sysfs: Fix NULL pointer deference in iscsi_sysfs_read_iface\n\n- Updatged to latest upstream, including:\n  * iscsiadm: Optimize the the verification of mode paramters\n  * iscsid: Poll timeout value to 1 minute for iscsid\n  * iscsiadm: fix host stats mode coredump\n  * iscsid: fix logging level when starting and shutting down daemon\n  * Updated iscsiadm man page.\n  * Fix memory leak in sysfs_get_str\n  * libopeniscsiusr: Compare with max int instead of max long\n\n- Systemd unit files should not depend on network.target (bsc#1179440).\n\n- Updated to latest upstream, including async login ability:\n * Implement login 'no_wait' for iscsiadm NODE mode\n * iscsiadm buffer overflow regression when discovering many targets at once\n * iscsid: Check Invalid Session id for stop connection\n * Add ability to attempt target logins asynchronously\n\n- %service_del_postun_without_restart is now available on SLE\n  More accurately it's been introduced in SLE12-SP2+ and SLE15+\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","ecosystems":["openSUSE:Leap 15.2"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Security update for open-iscsi","id":"openSUSE-SU-2021:0089-1","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2021"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"openSUSE:Leap 15.2","fixed":["2.1.3-lp152.18.6.1"],"introduced":["0"],"last_affected":[],"package":"open-iscsi","purl":"pkg:rpm/opensuse/open-iscsi\u0026distro=openSUSE%20Leap%2015.2","source":"openSUSE-SU-2021:0089-1"}],"products":null,"published":"2021-01-16","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Multiple memory corruption and NULL pointer dereference flaws in open-iscsi allow remote attackers to execute arbitrary code or cause denial of service.","url":"https://insights.sbomify.com/openSUSE-SU-2021-0089-1/"}