SUSE SLES15 Security Update : open-iscsi (SUSE-SU-2026:5224-1)

high Nessus Plugin ID 381000

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5224-1 advisory.

- CVE-2026-18724: Stack buffer overflow in idbm record parsing (bsc#1275171).
- CVE-2026-18725: Out-of-bounds access in iscsiuio ICMPv6 echo handling (bsc#1275258).
- CVE-2026-18726: Denial of service in iscsiuio Router Advertisement parsing (bsc#1275260).
- CVE-2026-18727: Integer underflow in iscsiuio DHCPv6 parsing (bsc#1275261).
- CVE-2026-18728: Integer underflow in iscsiuio IPv4 DHCP parsing (bsc#1275262).
- CVE-2026-44943: remote file-write as root via discovery (bsc#1268353).
- CVE-2026-44944: iscsiuio control-socket auth bypass (bsc#1268352).

Changes for open-iscsi:

- Update to version 2.1.13.suse+4.dc2446a1:
* iscsid: honor REPORT LUNS DATA HAS CHANGED again (#557)
* Convert shell scripts to POSIX sh (#552)
* Preparing for version 2.1.13
* iscsiuio: fix incorrect comparison of IPv6 subnet mask
* usr: verify IPC peer credentials before sending data
* login: fix infinite redirect loops with configurable limits
* iscsiuio: strengthen IPv6 payload length validation in uip_process()
* iscsiuio: strengthen DHCPv6 option parsing loop bound check
* iscsiuio: validate DHCPv6 IA_NA option lengths to prevent OOB reads
* usr: network code ioctl handling improvements
* fix typo in user-facing error message in verify_mode_params() (#548)
* gitignore: ignore generated build artifacts (#550)
* iscsiadm: handle getopt errors directly (#551)
* Fix iscsi_conn_iface_has_ip error handling (#531)
* Fix reopen log freq change (#542)
* iscsi_net_util: fix broken VLAN support in find_vlan_dev (#545)
* Fixes for CVEs CVE-2026-18724 - CVE-2026-18728 (#544)
* usr: fix '-Wdiscarded-qualifiers' warning in auth.c (#539)
* usr: Fix -Wdiscarded-qualifiers warning in iqn_name_valid (#537)
* iscsiuio: Fix -Waddress-of-packed-member (#534)
- Update to version 2.1.12.suse+0.8f77cf16:
* Preparing for version 2.1.12 (#536)
* iscsi-init.service: Use iscsi-gen-initiatorname
* iscsi-gen-initiatorname use @IQN_PREFIX@ as default
* avoid possible double free of found in idbm_rec_update_param (#528)
* iscsi: validate interface IP against target address family (#527)
- Update to version 2.1.11.suse+88.8e0635b3:
* Make iface.example a doc file. (#526)
* Updated SPEC file to deliver iface.example as a %doc file, no longer in the database directory.
- Update to version 2.1.11.suse+85.4ef97a15:
* Fix unused variable warning in usr/io.c (#524)
* Remove old rpm subdirectory, no longer needed.
* Add tcp.congestion_control configuration option (#520)
* Small cleanups for firmware discovery. (#522)
* Fix incorrect parsing of node.discovery_type 'static' and 'fw' (#518)
* iscsi_net_util: avoid copying NULL pointers with strlcpy() (#515)
* iscsi: delay reconnect until interface has valid IP. (#511)
- Update to version 2.1.11.suse+73.1723affc61eb:
* README for rpm build directory
* Fix issue with IPv6 adapter interfaces (#508, bsc#1240969)
* fwparam_ppc.c: Fix the calloc-transposed-args issue (#504)
* Makefile: fix 'No rule to make target 'iscsiuio/Makefile.in' issue (#506)
* Fix typo in initiator.c (#507)
- Fixed some issues in this changes file
* One date had incorrect format from 2014
* Two separator lines were formatted incrrectly
- Update to version 2.1.11.suse+66.13c070123738:
* Fix iscsid.conf NOP configuration (bsc#1240541)
- Change SPEC file so that open-iscsi lock files always go in /run/lock/iscsi (bsc#1239107)
- Update to version 2.1.11.suse+65.65365e1cdedb:
* doc: fixup iscsiadm man page option for -r (#501)
* Modify log function to print session id (#498)
* Fix minor typo ('authenticaton') (#500)
* Preparing for version 2.1.11 (#499)
* iscsid: Rate limit session reopen log messages (#492)
* IPv6 support for iBFT iSCSI boot (#493)
* Improve iscsiadm command line parsing messages (#494)
* More testing cleanup, and fix dprint test usage (#491)
* Fix a typo in test/README (#486)
* iscsid: Fix hang during login with scan=manual (#485)
* fix 4 issues which are finded when building with clang 17 (#478)
- Drop rcFOO symlinks for CODE16 (PED-266).
- Update to version 2.1.10.suse+51.fea0fde82ed1:
* Incudes upstream version 2.1.10 plus some fixes
* Fix firmware targets startup to always be 'onboot' (#482) (bsc#1228084)
* Change a discovery function to void return type (#481)
* Fix gcc issues (#480)
* Bugfix read specific sysfs value 'off' of session attribute (#466)
* Fix bug where abort_tmo read failures were ignored. (#467)
* grammar nitpicks (#464)
* Fix memory leak in iscsi_check_session_use_count (#465)
* improve the comments in idbm_lock() (#458)
* Make it visible when memory allocation failure (#457)
* Better handle multiple iscsiadm commands (#453)
* iscsiadm: allow hostnames in node-mode commands (#451)
* Modify how workqueue priority is set (#445)
* Fix authmethod check by printing a warning message when CHAP used and authmethod=None (#443)
* iscsid: Rescan devices on relogin (#444)
* Adds missing characters in README. (#440)
* Turn off iSCSI NOP-Outs, by default.
* fix: add usr/iscsid_req.h missinig underline (#431) (#436)
- Updated to latest upstream: two small changes, with no known functional changes:
* Incorrect documentation for `iscsiadm -m session` print level (upstream issue #432)
* Stop using deprecated inet_aton and inet_ntoa (upstream issue #435)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected iscsiuio, libopeniscsiusr0, open-iscsi and / or open-iscsi-devel packages.

Plugin Details

Severity: High

ID: 381000

File Name: suse_SU-2026-5224-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/14/2026

Updated: 11/14/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.18

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-44943

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-18728

CVSS v4

Risk Factor: High

Base Score: 8.5

Threat Score: 5.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-44944

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:iscsiuio, p-cpe:/a:novell:suse_linux:libopeniscsiusr0, p-cpe:/a:novell:suse_linux:open-iscsi-devel, p-cpe:/a:novell:suse_linux:open-iscsi

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/12/2026

Vulnerability Publication Date: 7/29/2026

Reference Information

CVE: CVE-2026-18724, CVE-2026-18725, CVE-2026-18726, CVE-2026-18727, CVE-2026-18728, CVE-2026-44943, CVE-2026-44944

SuSE: SUSE-SU-2026:5224-1

Detections

Analytics