CVE-Katalog

CVE-2020-17437

open-iscsi: CVE-2020-17437

Schweregrad: High · CVSS 8.2CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Published: Dec 1, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.81% · Oct 22, 2026

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	open-iscsi	sid	`2.1.13-1`	fixed
Debian	open-iscsi	forky	`2.1.13-1`	fixed
Debian	open-iscsi	trixie	`2.1.11-1+deb13u2`	fixed
Debian	open-iscsi	bookworm	`2.1.8-1`	fixed
Debian	open-iscsi	bookworm-security	`2.1.8-1+deb12u1`	fixed
Ubuntu	open-iscsi	pro	`2.0.874-4ubuntu3`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-4ubuntu4`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-4ubuntu5`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu1`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.1`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.2`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.3`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.4`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.6`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.7`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.9`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.10`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.11`	vulnerable
Ubuntu	open-iscsi	pro	`2.0.874-5ubuntu2.11+esm1`	fixed
Ubuntu	open-iscsi	20.04	`2.0.874-7.1ubuntu3`	vulnerable
Ubuntu	open-iscsi	20.04	`2.0.874-7.1ubuntu5`	vulnerable
Ubuntu	open-iscsi	20.04	`2.0.874-7.1ubuntu6`	vulnerable
Ubuntu	open-iscsi	20.04	`2.0.874-7.1ubuntu6.1`	vulnerable
Ubuntu	open-iscsi	20.04	`2.0.874-7.1ubuntu6.2`	vulnerable
Ubuntu	open-iscsi	20.04	`2.0.874-7.1ubuntu6.3`	vulnerable
Ubuntu	open-iscsi	20.04	`2.0.874-7.1ubuntu6.4`	fixed
Suse	open-iscsi	linux enterprise server 12 sp2-bcl	`2.0.873-46.17.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	open-iscsi	source	sid	`2.1.3-1`	not yet assigned	Not reported	Not reported
Debian	open-iscsi	source	forky	`2.1.3-1`	not yet assigned	Not reported	Not reported
Debian	open-iscsi	source	trixie	`2.1.3-1`	not yet assigned	Not reported	Not reported
Debian	open-iscsi	source	bookworm	`2.1.3-1`	not yet assigned	Not reported	Not reported
Ubuntu	open-iscsi	deb	pro	`2.0.874-5ubuntu2.11+esm1`	Not reported	UBUNTU-CVE-2020-17437	Not reported
Ubuntu	open-iscsi	deb	20.04	`2.0.874-7.1ubuntu6.4`	Not reported	UBUNTU-CVE-2020-17437	Not reported
Suse	open-iscsi	rpm	linux enterprise server 12 sp2-bcl	`2.0.873-46.17.2`	Not reported	SUSE-SU-2022:2861-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[iscsiuio]Behoben
Quellpaket: [open-iscsi]
Details (2)
- 2.1.8-1 · amd64 · bookworm
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · bookworm; dsa · open-iscsi · debian · 12
- 2.1.8-1 · arm64 · bookworm
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · bookworm; dsa · open-iscsi · debian · 12
[libopeniscsiusr]Behoben
Quellpaket: [open-iscsi]
Details (2)
- 2.1.8-1 · amd64 · bookworm
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · bookworm; dsa · open-iscsi · debian · 12
- 2.1.8-1 · arm64 · bookworm
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · bookworm; dsa · open-iscsi · debian · 12
[libopeniscsiusr-dev]Behoben
Quellpaket: [open-iscsi]
Details (2)
- 2.1.8-1 · all · bookworm
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · bookworm; dsa · open-iscsi · debian · 12
- 2.1.8-1 · all · bookworm
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · bookworm; dsa · open-iscsi · debian · 12
[open-iscsi]Behoben
Details (2)
- 2.1.8-1 · amd64 · bookworm
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · bookworm; dsa · open-iscsi · debian · 12
- 2.1.8-1 · arm64 · bookworm
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · bookworm; dsa · open-iscsi · debian · 12

[Debian 13 (Trixie)]

[iscsiuio]Behoben
Quellpaket: [open-iscsi]
Details (2)
- 2.1.11-1+deb13u2 · amd64 · trixie
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · 13
- 2.1.11-1+deb13u2 · arm64 · trixie
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · 13
[libopeniscsiusr]Behoben
Quellpaket: [open-iscsi]
Details (2)
- 2.1.11-1+deb13u2 · amd64 · trixie
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · 13
- 2.1.11-1+deb13u2 · arm64 · trixie
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · 13
[libopeniscsiusr-dev]Behoben
Quellpaket: [open-iscsi]
Details (2)
- 2.1.11-1+deb13u2 · all · trixie
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · 13
- 2.1.11-1+deb13u2 · all · trixie
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · 13
[open-iscsi]Behoben
Details (2)
- 2.1.11-1+deb13u2 · amd64 · trixie
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · 13
- 2.1.11-1+deb13u2 · arm64 · trixie
  Behoben · Behoben: 2.1.3-1
  dsa · open-iscsi · debian · 13

Beobachtet: Oct 23, 2026, 5:48:50 PM UTC

Referenzen

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]