CVE-2020-13987: open-iscsi_project open-iscsi Out-of-bounds Read
CVSS: 7.5v3.1HighModified
AliasesRHBA-2021:4446UBUNTU-CVE-2020-13987DEBIAN-CVE-2020-13987
Published 11-12-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-13987 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in open-iscsi_project open-iscsi. EPSS estimates a 3.26% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
3.26%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 11-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources4 sources · 5.3–7.5
- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
3.26%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.26% on 21-09-2026
21-09-202621-10-2026
EPSS score3.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat8 products
- iscsi-initiator-utils< 0:6.2.1.4-4.git095f59c.el8
- iscsi-initiator-utils-debuginfo< 0:6.2.1.4-4.git095f59c.el8
- iscsi-initiator-utils-debugsource< 0:6.2.1.4-4.git095f59c.el8
- iscsi-initiator-utils-devel< 0:6.2.1.4-4.git095f59c.el8
- iscsi-initiator-utils-iscsiuio< 0:6.2.1.4-4.git095f59c.el8
Siemens4 products
- sentron_3va_com100_firmware< 4.4.1
- sentron_3va_com800_firmware< 4.4.1
- sentron_pac3200_firmware< 2.4.7
- sentron_pac4200_firmware< 2.3.0
Debian1 product
- open-iscsi< 2.1.3-1
Open-iscsi_project1 product
- open-iscsi≤ 2.1.12
Ubuntu1 product
- open-iscsi< 2.0.873+git0.3b4b4500-14ubuntu3.7+esm1 | < 2.0.874-5ubuntu2.11+esm1 | < 2.0.874-7.1ubuntu6.4
Uip_project1 product
- uip≤ 1.0
6 vendors · 16 products
References
16 links
us-cert.cisa.gov/ics/advisories/icsa-20-343-01X Refsource MISCThird Party AdvisoryUS Government Resource
