Skip to content
OpenAdvisories
High ALAS2-2026-3867 3 CVEs

Important: iscsi-initiator-utils security update (Amazon Linux 2)

Published Aug 17, 2026 · Updated Aug 17, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-55995: A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-44944: An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e. CVE-2026-44943: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 iscsi-initiator-utils 0:6.2.0.874-7.amzn2.0.1
Amazon Linux · 2 iscsi-initiator-utils-debuginfo 0:6.2.0.874-7.amzn2.0.1
Amazon Linux · 2 iscsi-initiator-utils-devel 0:6.2.0.874-7.amzn2.0.1
Amazon Linux · 2 iscsi-initiator-utils-iscsiuio 0:6.2.0.874-7.amzn2.0.1

Vulnerabilities 3

  • High 8.7
    CVE-2026-55995

    Double-free in the iSNS attribute decoder in open-iscsi

    A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.

    open-iscsi open-iscsi open-iscsi open-isns Debian Ubuntu Azure Linux
  • High 8.5
    CVE-2026-44944

    iscsiuio control-socket authentication bypass in open-iscsi

    An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

    open-iscsi open-iscsi open-iscsi open-iscsi Debian Ubuntu Azure Linux
  • Medium 6.9
    CVE-2026-44943

    remote limited file-write as root via discovery in open-iscsi

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from t…

    open-iscsi open-iscsi open-iscsi open-iscsi Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-44943.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-44944.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-55995.html