{"action":"Upgrade tcmu to 1.5.2-6 or later.","affected":[{"fixed":"1.5.2-6","introduced":"0"}],"component":"tcmu","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["1.5.2-6"],"id":"tcs_01M5NFNMHBFDKM8EFBRZ8W9VVT","modified_at":"2026-10-23T18:03:14.019298721Z","published_at":"2021-01-13T16:15:14.617Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-3139","https://security-tracker.debian.org/tracker/CVE-2021-3139"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-3139","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-3139"}],"summary":"In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write fil"}