Описание
Security update for tcmu-runner
This update for tcmu-runner fixes the following issues:
- CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
Список пакетов
openSUSE Leap 15.2
libtcmu2-1.5.2-lp152.2.3.1
tcmu-runner-1.5.2-lp152.2.3.1
tcmu-runner-handler-rbd-1.5.2-lp152.2.3.1
Ссылки
- E-Mail link for openSUSE-SU-2021:0097-1
- SUSE Security Ratings
- SUSE Bug 1180676
- SUSE CVE CVE-2021-3139 page
Описание
In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.
Затронутые продукты
openSUSE Leap 15.2:libtcmu2-1.5.2-lp152.2.3.1
openSUSE Leap 15.2:tcmu-runner-1.5.2-lp152.2.3.1
openSUSE Leap 15.2:tcmu-runner-handler-rbd-1.5.2-lp152.2.3.1
Ссылки
- CVE-2021-3139
- SUSE Bug 1178684
- SUSE Bug 1180676