Summary
[1.44-6.1]
- sg_inq output conformance for SCSI name string and ATA fields (RHEL-188162)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | sg3_utils | 0:1.44-6.el8_10.1 |
| Oracle Linux · 8 | sg3_utils-devel | 0:1.44-6.el8_10.1 |
| Oracle Linux · 8 | sg3_utils-libs | 0:1.44-6.el8_10.1 |
Vulnerabilities 1
-
High 7.6
Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can in…