Google: sys-block/open-iscsi: security update to 17162.127.27

high Tenable Self-Hosted Container Security Plugin ID 452038

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set
in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the
value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the
offset at which the normal data should be present in the global buffer. However, the length of this offset
is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to
memory that is way beyond the data buffer in uip_process in uip.c. (CVE-2020-17437)

Solution

Update the sys-block/open-iscsi library and its related packages to version 17162.127.27 or later.

Plugin Details

Severity: High

ID: 452038

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.63

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2020-17437

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 12/11/2020

Reference Information

CVE: CVE-2020-17437

Detections

Analytics