Description
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | inetutils | 2:1.9.4-12 | — |
| Debian 14 | netkit-telnet-ssl | 0.17.17+0.1-2woody3 | — |
| Debian 13 | inetutils | 2:1.9.4-12 | — |
| Debian 13 | netkit-telnet-ssl | 0.17.17+0.1-2woody3 | — |
| Debian 12 | inetutils | 2:1.9.4-12 | — |
| Debian 12 | netkit-telnet-ssl | 0.17.17+0.1-2woody3 | — |
| Debian 9 | inetutils | 2:1.9.4-2+deb9u1 | DLA-2341-1 |
| Debian 8 | inetutils | 2:1.9.2.39.3a460-3+deb8u1 | DLA-2176-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | netkit-telnet-ssl | No fix yet | — |
| Ubuntu 26.04 LTS | netkit-telnet-ssl | No fix yet | — |
| Ubuntu 25.10 | netkit-telnet-ssl | No fix yet | — |
| Ubuntu 24.04 LTS | netkit-telnet-ssl | No fix yet | — |
| Ubuntu 22.04 LTS | netkit-telnet-ssl | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | inetutils | 2:1.9.4-11ubuntu0.1 | USN-5048-1 |
| Ubuntu 20.04 LTS | netkit-telnet-ssl | No fix yet | — |
| Ubuntu 18.04 LTS | inetutils | 2:1.9.4-3ubuntu0.1 | USN-5048-1 |
| Ubuntu 18.04 LTS | netkit-telnet-ssl | No fix yet | — |
| Ubuntu 16.04 LTS | netkit-telnet-ssl | No fix yet | — |
| Ubuntu Pro 18.04 LTS | inetutils | 2:1.9.4-3ubuntu0.1+esm2 | USN-7781-1 |
| Ubuntu Pro 16.04 LTS | inetutils | 2:1.9.4-1ubuntu0.1~esm1 | USN-7781-1, USN-5048-2 |
| Ubuntu Pro 14.04 LTS | inetutils | 2:1.9.2-1ubuntu0.1~esm2 | USN-7781-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | telnet +1 | 1:0.17-73.el8_1.1 | RHSA-2020:1318 |
| RHEL 7 | telnet +1 | 1:0.17-65.el7_8 | RHSA-2020:1334 |
| RHEL 6 | krb5-appl +1 | 1.0.1-10.el6_10 | RHSA-2020:1349 |
| RHEL 6 | telnet +1 | 1:0.17-49.el6_10 | RHSA-2020:1335 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.0 E4S | telnet +1 | 1:0.17-73.el8_0.1 | RHSA-2020:1342 |
| RHEL 7.7 TUS | telnet +1 | 1:0.17-65.el7_7 | RHSA-2022:0158 |
| RHEL 7.7 E4S | telnet +1 | 1:0.17-65.el7_7 | RHSA-2022:0158 |
| RHEL 7.7 AUS | telnet +1 | 1:0.17-65.el7_7 | RHSA-2022:0158 |
| RHEL 7.6 TUS | telnet +1 | 1:0.17-65.el7_6 | RHSA-2022:0011 |
| RHEL 7.6 E4S | telnet +1 | 1:0.17-65.el7_6 | RHSA-2022:0011 |
| RHEL 7.6 AUS | telnet +1 | 1:0.17-65.el7_6 | RHSA-2022:0011 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SLES 12 SP4 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SLES 12 SP3 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SLES 12 SP2 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SLES for SAP 12 SP4 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SLES for SAP 12 SP3 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SLES for SAP 12 SP2 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SUSE OpenStack Cloud Crowbar 8 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SUSE OpenStack Cloud 8 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SUSE OpenStack Cloud 7 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SUSE HPE Helion OpenStack 8 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
| SUSE Enterprise Storage 5 | krb5-appl | 1.0.3-3.3.1 | SUSE-SU-2020:1533-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | telnet +1 | 1:0.17-65.amzn2 | ALAS2-2020-1422 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | telnet +1 | 1:0.17-73.el8_1.1 | ELSA-2020-1318 |
| Oracle Linux 7 | telnet +1 | 1:0.17-65.el7_8 | ELSA-2020-1334 |
Advisories 17
- RHSA-2022:0158 Red Hat Security Advisory: telnet security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0011 Red Hat Security Advisory: telnet security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2020:1342 Red Hat Security Advisory: telnet security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2020:1349 Red Hat Security Advisory: krb5-appl security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2020:1334 Red Hat Security Advisory: telnet security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2020:1335 Red Hat Security Advisory: telnet security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2020:1318 Red Hat Security Advisory: telnet security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- USN-7781-1 inetutils vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5048-2 inetutils vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5048-1 inetutils vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2341-1 inetutils - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2176-1 inetutils - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2020:1533-1 Security update for krb5-appl SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2025-0798 HPE HP-UX: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Apr 14, 2025
- ALAS2-2020-1422 Important: telnet security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 6, 2020
- ELSA-2020-1334 Important: telnet security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 11, 2020
- ELSA-2020-1318 Important: telnet security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 7, 2020
References
- FEDORA-2020-11ea78ff8e vendor-advisory
- FEDORA-2020-e7b942a47a vendor-advisory
- FEDORA-2020-6b07ff2526 vendor-advisory
- [debian-lts-announce] 20200514 [SECURITY] [DLA 2176-1] inetutils security update mailing-list
- 20200624 Telnet Vulnerability Affecting Cisco Products: June 2020 vendor-advisory
- [debian-lts-announce] 20200824 [SECURITY] [DLA 2341-1] inetutils security update mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://appgateresearch.blogspot.com/2020/02/bravestarr-fedora-31-netkit-telnetd_28.html
- https://github.com/krb5/krb5-appl/blob/d00cd671dfe945791b33d4f1f6a5c57ae1667ef8/telnet/telnetd/utility.c#L205-L216
- https://www.arista.com/en/support/advisories-notices/security-advisories/10702-security-advisory-48