CVE catalog
CVE-2020-10188
inetutils: CVE-2020-10188
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 74.34% · Oct 22, 2026
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | inetutils | sid | 2:2.8-4 | fixed |
| Debian | inetutils | forky | 2:2.8-4 | fixed |
| Debian | inetutils | trixie | 2:2.6-3+deb13u3 | fixed |
| Debian | inetutils | trixie-security | 2:2.6-3+deb13u3 | fixed |
| Debian | inetutils | bookworm | 2:2.4-2+deb12u3 | fixed |
| Debian | inetutils | bookworm-security | 2:2.4-2+deb12u3 | fixed |
| Debian | netkit-telnet-ssl | sid | 0.17.41+really0.17-8 | fixed |
| Debian | netkit-telnet-ssl | forky | 0.17.41+really0.17-8 | fixed |
| Debian | netkit-telnet-ssl | trixie | 0.17.41+really0.17-6 | fixed |
| Debian | netkit-telnet-ssl | bookworm | 0.17.41+really0.17-3 | fixed |
| Ubuntu | inetutils | pro | 2:1.9.4-1 | vulnerable |
| Ubuntu | inetutils | pro | 2:1.9.4-1build1 | vulnerable |
| Ubuntu | inetutils | pro | 2:1.9.4-1ubuntu0.1~esm1 | fixed |
| Ubuntu | inetutils | 18.04 | 2:1.9.4-2build1 | vulnerable |
| Ubuntu | inetutils | 18.04 | 2:1.9.4-3 | vulnerable |
| Ubuntu | inetutils | 18.04 | 2:1.9.4-3ubuntu0.1 | fixed |
| Ubuntu | inetutils | 20.04 | 2:1.9.4-10build1 | vulnerable |
| Ubuntu | inetutils | 20.04 | 2:1.9.4-11 | vulnerable |
| Ubuntu | inetutils | 20.04 | 2:1.9.4-11ubuntu0.1 | fixed |
| Suse | krb5-appl | hpe helion openstack 8 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | openstack cloud 7 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | openstack cloud 8 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | openstack cloud crowbar 8 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server for sap applications 12 sp2 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server for sap applications 12 sp3 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server 12 sp2-ltss | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server 12 sp2-bcl | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server 12 sp3-ltss | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server 12 sp3-bcl | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server 12 sp4 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server for sap applications 12 sp4 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server 12 sp5 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | linux enterprise server for sap applications 12 sp5 | 1.0.3-3.3.1 | fixed |
| Suse | krb5-appl | enterprise storage 5 | 1.0.3-3.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | inetutils | source | sid | 2:1.9.4-12 | not yet assigned | Not reported | [956084] |
| Debian | inetutils | source | forky | 2:1.9.4-12 | not yet assigned | Not reported | [956084] |
| Debian | inetutils | source | trixie | 2:1.9.4-12 | not yet assigned | Not reported | [956084] |
| Debian | inetutils | source | bookworm | 2:1.9.4-12 | not yet assigned | Not reported | [956084] |
| Debian | netkit-telnet-ssl | source | sid | 0.17.17+0.1-2woody3 | not yet assigned | Not reported | [953478] |
| Debian | netkit-telnet-ssl | source | forky | 0.17.17+0.1-2woody3 | not yet assigned | Not reported | [953478] |
| Debian | netkit-telnet-ssl | source | trixie | 0.17.17+0.1-2woody3 | not yet assigned | Not reported | [953478] |
| Debian | netkit-telnet-ssl | source | bookworm | 0.17.17+0.1-2woody3 | not yet assigned | Not reported | [953478] |
| Ubuntu | inetutils | deb | pro | 2:1.9.4-1ubuntu0.1~esm1 | Not reported | USN-5048-2 | Not reported |
| Ubuntu | inetutils | deb | 18.04 | 2:1.9.4-3ubuntu0.1 | Not reported | USN-5048-1 | Not reported |
| Ubuntu | inetutils | deb | 20.04 | 2:1.9.4-11ubuntu0.1 | Not reported | USN-5048-1 | Not reported |
| Suse | krb5-appl | rpm | hpe helion openstack 8 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | openstack cloud 7 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | openstack cloud 8 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | openstack cloud crowbar 8 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server for sap applications 12 sp2 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server for sap applications 12 sp3 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server 12 sp2-ltss | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server 12 sp2-bcl | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server 12 sp3-ltss | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server 12 sp3-bcl | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server 12 sp4 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server for sap applications 12 sp4 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server 12 sp5 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | linux enterprise server for sap applications 12 sp5 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
| Suse | krb5-appl | rpm | enterprise storage 5 | 1.0.3-3.3.1 | Not reported | SUSE-SU-2020:1533-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [inetutils-ftp]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-ftpd]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-inetd]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-ping]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-syslogd]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-talk]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-talkd]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-telnet]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-telnetd]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-tools]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [inetutils-traceroute]Fixed
Source package: [inetutils]
Details (4)
2:2.4-2+deb12u3· amd64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· amd64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
2:2.4-2+deb12u3· arm64 · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [telnet]Fixed
Source package: [inetutils]
Details (4)
0.17+2.4-2+deb12u3· all · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
0.17+2.4-2+deb12u3· all · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
0.17+2.4-2+deb12u3· all · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
0.17+2.4-2+deb12u3· all · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [telnetd]Fixed
Source package: [inetutils]
Details (4)
0.17+2.4-2+deb12u3· all · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
0.17+2.4-2+deb12u3· all · bookwormFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
0.17+2.4-2+deb12u3· all · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
0.17+2.4-2+deb12u3· all · bookworm-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · bookworm; dsa · inetutils · debian · 12
- [telnetd-ssl]Fixed
Source package: [netkit-telnet-ssl]
Details (2)
0.17.41+really0.17-3· amd64 · bookwormFixed · Fixed:
0.17.17+0.1-2woody3dsa · netkit-telnet-ssl · debian · bookworm; dsa · netkit-telnet-ssl · debian · 12
0.17.41+really0.17-3· arm64 · bookwormFixed · Fixed:
0.17.17+0.1-2woody3dsa · netkit-telnet-ssl · debian · bookworm; dsa · netkit-telnet-ssl · debian · 12
- [telnet-ssl]Fixed
Source package: [netkit-telnet-ssl]
Details (2)
0.17.41+really0.17-3· amd64 · bookwormFixed · Fixed:
0.17.17+0.1-2woody3dsa · netkit-telnet-ssl · debian · bookworm; dsa · netkit-telnet-ssl · debian · 12
0.17.41+really0.17-3· arm64 · bookwormFixed · Fixed:
0.17.17+0.1-2woody3dsa · netkit-telnet-ssl · debian · bookworm; dsa · netkit-telnet-ssl · debian · 12
[Debian 13 (Trixie)]
- [inetutils-ftp]Fixed
Source package: [inetutils]
Details (4)
2:2.6-3+deb13u3· amd64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
- [inetutils-ftpd]Fixed
Source package: [inetutils]
Details (4)
2:2.6-3+deb13u3· amd64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
- [inetutils-inetd]Fixed
Source package: [inetutils]
Details (4)
2:2.6-3+deb13u3· amd64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
- [inetutils-ping]Fixed
Source package: [inetutils]
Details (4)
2:2.6-3+deb13u3· amd64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
- [inetutils-syslogd]Fixed
Source package: [inetutils]
Details (4)
2:2.6-3+deb13u3· amd64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixieFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
2:2.6-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
2:1.9.4-12dsa · inetutils · debian · 13
Observed:
References
- [https://access.redhat.com/errata/RHSA-2020:1318]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2020-10188]
- [https://osv.dev/vulnerability/DLA-2176-1]
- [https://osv.dev/vulnerability/DLA-2341-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:1533-1]
- [https://osv.dev/vulnerability/USN-5048-1]
- [https://osv.dev/vulnerability/USN-5048-2]
- [https://security-tracker.debian.org/tracker/CVE-2020-10188]
- [https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2025-0798.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]