A new upstream version 2.1.2 is available, you should consider packaging it.
Standards version of the package is outdated.
high
The package is severely out of date with respect to the Debian Policy.The package should be updated to follow the last version of Debian Policy
(Standards-Version 4.5.0 instead of
3.9.8).
Depends on packages which need a new maintainer
normal
The packages that open-iscsi depends on which need a new maintainer are:
vcswatch reports that
this package seems to have a new changelog entry (version
2.1.1-2, distribution
unstable) and new commits
in its VCS. You should consider whether it's time to make
an upload.
CVE-2017-17840: An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/o/open-iscsi.png){kind=link}