OESA-2024-1354

    Dashboard / Vulnerabilities / OESA-2024-1354

    OESA-2024-1354

    Published: 3 Apr 2024Last Modified: 18 Aug 2026
    Upstream:
    CVE-2022-39028

    Summary: telnet security update

    Details: Telnet is an application protocol used on the Internet or local area network to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection. The package includes a remote login client program for telnet and a server daemon. Security Fix(es): telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.(CVE-2022-39028)

    References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1354, https://nvd.nist.gov/vuln/detail/CVE-2022-39028

    Affected packages

    Package

    Name: telnet

    Purl: pkg:rpm/openEuler/telnet&distro=openEuler-22.03-LTS-SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.17-79.oe2203sp1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2024-1354 | CVE-DB