{"schema_version":"1.7.2","id":"OESA-2026-3244","modified":"2026-08-07T02:41:42Z","published":"2026-08-07T02:41:42Z","upstream":["CVE-2026-16313"],"summary":"sg3_utils security update","details":"The sg3_utils package contains utilities that send SCSI commands to devices. As well as devices on transports traditionally associated with SCSI (e.g. Fibre Channel (FCP), Serial Attached SCSI (SAS) and the SCSI Parallel Interface(SPI)) many other devices use SCSI command sets. ATAPI cd/dvd drives and SATA disks that connect via a translation layer or a bridge device are examples of devices that use SCSI command sets.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.(CVE-2026-16313)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP3","name":"sg3_utils","purl":"pkg:rpm/openEuler/sg3_utils&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.48-4.oe2403sp3"}]}],"ecosystem_specific":{"aarch64":["sg3_utils-1.48-4.oe2403sp3.aarch64.rpm","sg3_utils-debuginfo-1.48-4.oe2403sp3.aarch64.rpm","sg3_utils-debugsource-1.48-4.oe2403sp3.aarch64.rpm","sg3_utils-devel-1.48-4.oe2403sp3.aarch64.rpm","sg3_utils-help-1.48-4.oe2403sp3.aarch64.rpm"],"src":["sg3_utils-1.48-4.oe2403sp3.src.rpm"],"x86_64":["sg3_utils-1.48-4.oe2403sp3.x86_64.rpm","sg3_utils-debuginfo-1.48-4.oe2403sp3.x86_64.rpm","sg3_utils-debugsource-1.48-4.oe2403sp3.x86_64.rpm","sg3_utils-devel-1.48-4.oe2403sp3.x86_64.rpm","sg3_utils-help-1.48-4.oe2403sp3.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP4","name":"sg3_utils","purl":"pkg:rpm/openEuler/sg3_utils&distro=openEuler-24.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.48-4.oe2403sp4"}]}],"ecosystem_specific":{"aarch64":["sg3_utils-1.48-4.oe2403sp4.aarch64.rpm","sg3_utils-debuginfo-1.48-4.oe2403sp4.aarch64.rpm","sg3_utils-debugsource-1.48-4.oe2403sp4.aarch64.rpm","sg3_utils-devel-1.48-4.oe2403sp4.aarch64.rpm","sg3_utils-help-1.48-4.oe2403sp4.aarch64.rpm"],"src":["sg3_utils-1.48-4.oe2403sp4.src.rpm"],"x86_64":["sg3_utils-1.48-4.oe2403sp4.x86_64.rpm","sg3_utils-debuginfo-1.48-4.oe2403sp4.x86_64.rpm","sg3_utils-debugsource-1.48-4.oe2403sp4.x86_64.rpm","sg3_utils-devel-1.48-4.oe2403sp4.x86_64.rpm","sg3_utils-help-1.48-4.oe2403sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"sg3_utils","purl":"pkg:rpm/openEuler/sg3_utils&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.45-14.oe2003sp4"}]}],"ecosystem_specific":{"aarch64":["sg3_utils-1.45-14.oe2003sp4.aarch64.rpm","sg3_utils-debuginfo-1.45-14.oe2003sp4.aarch64.rpm","sg3_utils-debugsource-1.45-14.oe2003sp4.aarch64.rpm","sg3_utils-devel-1.45-14.oe2003sp4.aarch64.rpm","sg3_utils-help-1.45-14.oe2003sp4.aarch64.rpm"],"src":["sg3_utils-1.45-14.oe2003sp4.src.rpm"],"x86_64":["sg3_utils-1.45-14.oe2003sp4.x86_64.rpm","sg3_utils-debuginfo-1.45-14.oe2003sp4.x86_64.rpm","sg3_utils-debugsource-1.45-14.oe2003sp4.x86_64.rpm","sg3_utils-devel-1.45-14.oe2003sp4.x86_64.rpm","sg3_utils-help-1.45-14.oe2003sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"sg3_utils","purl":"pkg:rpm/openEuler/sg3_utils&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.46-10.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["sg3_utils-1.46-10.oe2203sp4.aarch64.rpm","sg3_utils-debuginfo-1.46-10.oe2203sp4.aarch64.rpm","sg3_utils-debugsource-1.46-10.oe2203sp4.aarch64.rpm","sg3_utils-devel-1.46-10.oe2203sp4.aarch64.rpm","sg3_utils-help-1.46-10.oe2203sp4.aarch64.rpm"],"src":["sg3_utils-1.46-10.oe2203sp4.src.rpm"],"x86_64":["sg3_utils-1.46-10.oe2203sp4.x86_64.rpm","sg3_utils-debuginfo-1.46-10.oe2203sp4.x86_64.rpm","sg3_utils-debugsource-1.46-10.oe2203sp4.x86_64.rpm","sg3_utils-devel-1.46-10.oe2203sp4.x86_64.rpm","sg3_utils-help-1.46-10.oe2203sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"sg3_utils","purl":"pkg:rpm/openEuler/sg3_utils&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.48-4.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["sg3_utils-1.48-4.oe2403sp1.aarch64.rpm","sg3_utils-debuginfo-1.48-4.oe2403sp1.aarch64.rpm","sg3_utils-debugsource-1.48-4.oe2403sp1.aarch64.rpm","sg3_utils-devel-1.48-4.oe2403sp1.aarch64.rpm","sg3_utils-help-1.48-4.oe2403sp1.aarch64.rpm"],"src":["sg3_utils-1.48-4.oe2403sp1.src.rpm"],"x86_64":["sg3_utils-1.48-4.oe2403sp1.x86_64.rpm","sg3_utils-debuginfo-1.48-4.oe2403sp1.x86_64.rpm","sg3_utils-debugsource-1.48-4.oe2403sp1.x86_64.rpm","sg3_utils-devel-1.48-4.oe2403sp1.x86_64.rpm","sg3_utils-help-1.48-4.oe2403sp1.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3244"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16313"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"database_specific":{"severity":"High"}}