Public bug reported:
A new release of sg3-utils is available for merging from Debian.
Ubuntu: 1.48-3ubuntu5
Debian Unstable: 1.48-4
### New Debian Changes ###
sg3-utils (1.48-4) unstable; urgency=high
* Sanitize control characters in sg_inq --export SCSI name string and ATA
identifier fields (CVE-2026-16313, Closes: #1143004)
-- Ritesh Raj Sarraf <[email protected]> Thu, 08 Oct 2026 14:08:53 +0530
### Old Ubuntu Delta ###
sg3-utils (1.48-3ubuntu5) stonking; urgency=medium
* SECURITY UPDATE: command injection via udev property injection
- debian/patches/CVE-2026-16313.patch: apply udev-conforming character
encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA
subfield output of sg_inq --export, so a crafted SCSI device cannot
inject udev properties and execute commands as root (fix released
upstream in sg3_utils 1.49).
- debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI
name strings (upstream follow-up fix).
- CVE-2026-16313
-- Allen Huang <[email protected]> Thu, 01 Oct 2026 14:12:09
+0100
sg3-utils (1.48-3ubuntu4) stonking; urgency=medium
* d/p/lp2152092-sg_wr_mode-fix-contents-and-cfile=-handling: fix
command-line argument handling for --contents and --cfile in sg_wr_mode
(LP: #2152092)
-- Guilherme Puida Moreira <[email protected]> Thu, 21
May 2026 14:38:58 -0300
sg3-utils (1.48-3ubuntu3) resolute; urgency=medium
* Recommend dracut as default initrd generator (LP: #2142775)
-- Benjamin Drung <[email protected]> Fri, 27 Feb 2026 18:12:12 +0100
sg3-utils (1.48-3ubuntu2) resolute; urgency=medium
* udev rules: avoid spurious warning for non-SCSI devices (LP:
#2139306)
-- Benjamin Drung <[email protected]> Wed, 28 Jan 2026 18:54:15 +0100
sg3-utils (1.48-3ubuntu1) resolute; urgency=medium
* Merge with Debian unstable (LP: #2125993). Remaining changes:
- d/p/0001-Fix-path-for-udevadm.patch: update to match 1.48 and use /usr/bin
-- Hector Cao <[email protected]> Mon, 24 Nov 2025 15:28:07
+0100
** Affects: sg3-utils (Ubuntu)
Importance: Wishlist
Status: New
** Tags: needs-merge upgrade-software-version
** Changed in: sg3-utils (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: sg3-utils (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171157
Title:
Merge sg3-utils 1.48-4 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sg3-utils/+bug/2171157/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
