Skip to content
OpenAdvisories
High ALAS2023-2026-2066 2 CVEs

Important: iscsi-initiator-utils security update (Amazon Linux 2023)

Published Aug 17, 2026 · Updated Aug 17, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-44944: An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e. CVE-2026-44943: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 iscsi-initiator-utils 0:6.2.1.4-10.git2a8f9d8.amzn2023.0.3
Amazon Linux · 2023 iscsi-initiator-utils-debuginfo 0:6.2.1.4-10.git2a8f9d8.amzn2023.0.3
Amazon Linux · 2023 iscsi-initiator-utils-debugsource 0:6.2.1.4-10.git2a8f9d8.amzn2023.0.3
Amazon Linux · 2023 iscsi-initiator-utils-devel 0:6.2.1.4-10.git2a8f9d8.amzn2023.0.3
Amazon Linux · 2023 iscsi-initiator-utils-iscsiuio 0:6.2.1.4-10.git2a8f9d8.amzn2023.0.3
Amazon Linux · 2023 iscsi-initiator-utils-iscsiuio-debuginfo 0:6.2.1.4-10.git2a8f9d8.amzn2023.0.3
Amazon Linux · 2023 python3-iscsi-initiator-utils 0:6.2.1.4-10.git2a8f9d8.amzn2023.0.3
Amazon Linux · 2023 python3-iscsi-initiator-utils-debuginfo 0:6.2.1.4-10.git2a8f9d8.amzn2023.0.3

Vulnerabilities 2

  • High 8.5
    CVE-2026-44944

    iscsiuio control-socket authentication bypass in open-iscsi

    An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

    open-iscsi open-iscsi open-iscsi open-iscsi Debian Ubuntu Azure Linux
  • Medium 6.9
    CVE-2026-44943

    remote limited file-write as root via discovery in open-iscsi

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from t…

    open-iscsi open-iscsi open-iscsi open-iscsi Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-44943.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-44944.html