CVE-2020-14019 rtslib-fb weak permissions for /etc/target/saveconfig.json file
Weak file permissions on saveconfig.json allow local attackers to read sensitive iSCSI target configuration data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14019?
CVE-2020-14019 is a high-severity vulnerability in n/a, published on 19 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
Weakness: CWE-276
Which versions are affected by CVE-2020-14019?
3 open source packages ship an affected version, including rtslib-fb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rtslib-fb PyPI | All versions | 2.1.73 |
rtslib-fb PyPI | All versions | 2.1.73 |
rtslib-fb PyPI | All versions | 2.1.73 |
Linux distribution packages (13)
python-rtslib Red Hat:enterprise_linux:7::client | All versions | 0:2.1.74-1.el7_9 |
python-rtslib-doc Red Hat:enterprise_linux:7::client | All versions | 0:2.1.74-1.el7_9 |
python-rtslib-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:2.1.74-1.el7_9 |
python-rtslib Red Hat:enterprise_linux:7::server | All versions | 0:2.1.74-1.el7_9 |
python-rtslib-doc Red Hat:enterprise_linux:7::server | All versions | 0:2.1.74-1.el7_9 |
python-rtslib Red Hat:enterprise_linux:7::workstation | All versions | 0:2.1.74-1.el7_9 |
python-rtslib-doc Red Hat:enterprise_linux:7::workstation | All versions | 0:2.1.74-1.el7_9 |
python-rtslib Red Hat:enterprise_linux:8::baseos | All versions | 0:2.1.73-2.el8 |
python3-rtslib Red Hat:enterprise_linux:8::baseos | All versions | 0:2.1.73-2.el8 |
target-restore Red Hat:enterprise_linux:8::baseos | All versions | 0:2.1.73-2.el8 |
python-rtslib-fb SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 2.1.73-3.3.1 |
python-rtslib-fb SUSE:Linux Enterprise Module for Python 2 15 SP2 | All versions | 2.1.73-3.3.1 |
python-rtslib-fb openSUSE:Leap 15.2 | All versions | 2.1.73-lp152.2.3.1 |
Products include Rtslib-Fb Project Rtslib-Fb.
How do I fix CVE-2020-14019?
Upgrade rtslib-fb to 2.1.73 or later.
Is CVE-2020-14019 being exploited?
There is no known exploitation of CVE-2020-14019 in the wild and no public exploit code.
Sources
Also known as AZL-44778, DEBIAN-CVE-2020-14019, GHSA-cpcw-p965-wpqx, MGASA-2020-0336, PYSEC-2020-250, RHEA-2020:4505 and 5 more.