CVE-2020-14019: Weak Permissions in Open-iSCSI rtslib-fb
Summary
CVE-2020-14019: Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved. Affects rtslib-fb versions < 2.1.73. Fixed in 2.1.73. How to fix ↓
Also tracked for
- python-rtslib-fb · Debian:11
The same CVE-2020-14019 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Open-iSCSI rtslib-fb is a Python package available on PyPI that provides an API for managing iSCSI targets. It allows users to create, configure, and manage iSCSI targets on Linux systems. The package is widely used in various applications and environments.
Vulnerability Detail
The vulnerability identified as CVE-2020-14019 affects Open-iSCSI rtslib-fb versions up to 2.1.72. The issue arises from weak permissions set for the file '/etc/target/saveconfig.json'. The vulnerable code uses 'shutil.copyfile' instead of 'shutil.copy', resulting in the preservation of incorrect permissions for the file. This vulnerability could allow an attacker with local access to modify the saveconfig.json file, potentially leading to unauthorized changes in the iSCSI target configuration.
How To Fix
Minimum fixed version
2.1.73
This is the first release that contains the fix.
pip install --upgrade "rtslib-fb==2.1.73"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually set the correct permissions for the saveconfig.json file. This can be done by executing the following command:
chmod 600 /etc/target/saveconfig.json
This command ensures that only the owner of the file has read and write permissions, while others have no access.
Conclusion
In conclusion, the vulnerability CVE-2020-14019 in Open-iSCSI rtslib-fb versions up to 2.1.72 allows for weak permissions on the saveconfig.json file, potentially enabling unauthorized modifications to the iSCSI target configuration. It is crucial to update to version 2.1.73 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rtslib-fb →
FAQ
Open-iSCSI rtslib-fb is a Python package that provides an API for managing iSCSI targets on Linux systems. It allows users to create, configure, and manage iSCSI targets.
This vulnerability could allow an attacker with local access to modify the saveconfig.json file, potentially leading to unauthorized changes in the iSCSI target configuration.
Versions up to 2.1.72 of Open-iSCSI rtslib-fb are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Open-iSCSI rtslib-fb version 2.1.73 or later.
Yes, a temporary workaround is to manually set the correct permissions for the saveconfig.json file using the 'chmod' command.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
