Vulnerability Name:

CVE-2020-14019 (CCN-184605)

Assigned:2020-05-28
Published:2020-05-28
Updated:2020-08-07
Summary:Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
6.6 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)
5.8 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-276
CWE-282
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2020-14019

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2020:1156

Source: XF
Type: UNKNOWN
openiscsi-cve202014019-info-disc(184605)

Source: CCN
Type: Open-iSCSI GIT Repository
saveconfig: open the temp configfile with modes set #162

Source: MISC
Type: Third Party Advisory
https://github.com/open-iscsi/rtslib-fb/pull/162

Source: FEDORA
Type: UNKNOWN
FEDORA-2020-46ec9e748b

Vulnerable Configuration:Configuration 1:
  • cpe:/a:rtslib-fb_project:rtslib-fb:*:*:*:*:*:*:*:* (Version <= 2.1.72)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:202014019
    V
    		CVE-2020-14019
    2023-06-22
    oval:org.opensuse.security:def:7757
    P
    		python-rtslib-fb-common-2.1.75-150500.1.4 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3160
    P
    		libcairo-gobject2-1.15.2-25.3.2 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94790
    P
    		python-rtslib-fb-common-2.1.74-1.29 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:277
    P
    		python-rtslib-fb-common-2.1.74-1.29 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:1206
    P
    		Security update for hdf5 (Important)
    2022-06-08
    oval:org.opensuse.security:def:4702
    P
    		Security update for the Linux Kernel (Important)
    2022-03-09
    oval:org.opensuse.security:def:113223
    P
    		python-rtslib-fb-common-2.1.74-2.7 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:64828
    P
    		Security update for openssh (Important)
    2021-12-22
    oval:org.opensuse.security:def:67001
    P
    		Security update for brotli (Moderate)
    2021-12-06
    oval:org.opensuse.security:def:67333
    P
    		Security update for python-Pygments (Important)
    2021-12-01
    oval:org.opensuse.security:def:51700
    P
    		Security update for webkit2gtk3 (Important)
    2021-11-23
    oval:org.opensuse.security:def:106641
    P
    		python-rtslib-fb-common-2.1.74-2.7 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:64770
    P
    		Security update for the Linux Kernel (Important)
    2021-09-23
    oval:org.opensuse.security:def:63223
    P
    		libwsman-devel-2.6.7-3.3.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:73692
    P
    		Security update for java-11-openjdk (Important)
    2021-09-03
    oval:org.opensuse.security:def:66909
    P
    		Security update for mariadb (Moderate)
    2021-08-25
    oval:org.opensuse.security:def:64561
    P
    		Security update for libmspack (Moderate)
    2021-08-20
    oval:org.opensuse.security:def:64560
    P
    		Security update for krb5 (Important)
    2021-08-20
    oval:org.opensuse.security:def:48353
    P
    		yast2-core-3.3.1-1.7 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48354
    P
    		yast2-users-3.2.19-1.16 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:63516
    P
    		python2-waitress-1.4.3-3.3.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63020
    P
    		libgit2-28-0.28.4-1.28 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101087
    P
    		squashfs-4.4-1.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63013
    P
    		groovy-lib-2.4.21-3.3.2 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62295
    P
    		python-rtslib-fb-common-2.1.74-1.29 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63017
    P
    		jetty-http-9.4.38-3.6.2 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63045
    P
    		velocity-1.7-3.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101053
    P
    		python-rtslib-fb-common-2.1.74-1.29 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:72036
    P
    		python-rtslib-fb-common-2.1.74-1.29 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:51630
    P
    		Security update for djvulibre (Important)
    2021-08-05
    oval:org.opensuse.security:def:70252
    P
    		Security update for ovmf (Important)
    2021-06-25
    oval:org.opensuse.security:def:70786
    P
    		Security update for gupnp (Important)
    2021-06-24
    oval:org.opensuse.security:def:48491
    P
    		libexif12-0.6.21-6.3 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48917
    P
    		lhasa-0.2.0-5.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48687
    P
    		libmysqlclient_r18-10.0.11-6.4 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48369
    P
    		apache2-mod_jk-1.2.40-5.2 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48824
    P
    		bash-lang-4.3-82.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:51545
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:64668
    P
    		Security update for s390-tools (Important)
    2021-03-12
    oval:org.opensuse.security:def:70357
    P
    		Security update for openldap2 (Important)
    2021-03-08
    oval:org.opensuse.security:def:51174
    P
    		Security update for openldap2 (Important)
    2021-03-03
    oval:org.opensuse.security:def:51734
    P
    		Security update for java-1_7_1-ibm (Important)
    2021-02-18
    oval:org.opensuse.security:def:94374
    P
    		 (Moderate)
    2021-01-20
    oval:org.opensuse.security:def:49440
    P
    		Security update for php74 (Moderate)
    2021-01-14
    oval:org.opensuse.security:def:73574
    P
    		Security update for xen (Moderate)
    2020-12-22
    oval:org.opensuse.security:def:4052
    P
    		Security update for MozillaFirefox (Critical)
    2020-12-21
    oval:com.redhat.rhsa:def:20205435
    P
    		RHSA-2020:5435: python-rtslib security update (Moderate)
    2020-12-15
    oval:org.opensuse.security:def:1841
    P
    		FastCGI-2.4.0-2.23 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1859
    P
    		dpkg-1.19.0.4-2.30 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3940
    P
    		libXi-devel-1.7.4-18.6.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4057
    P
    		libssh-devel-0.8.7-1.31 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1837
    P
    		subversion-bash-completion-1.10.0-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1850
    P
    		build-20200124.1-1.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4060
    P
    		libsvn_auth_kwallet-1-0-1.8.10-24.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3897
    P
    		gdk-pixbuf-devel-2.34.0-19.17.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4029
    P
    		libpcrecpp0-8.39-8.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2501
    P
    		libpskc-devel-2.6.2-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1863
    P
    		glibc-devel-32bit-2.26-8.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1846
    P
    		blktrace-1.1.0+git.20170126-3.3.28 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2505
    P
    		libstaroffice-0_0-0-0.0.6-5.17 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3847
    P
    		aaa_base-malloccheck-13.2+git20140911.61c1681-38.13.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3956
    P
    		libarchive-devel-3.1.2-26.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1838
    P
    		systemtap-3.2-7.6.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1857
    P
    		cvs-1.12.12-2.30 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1836
    P
    		rpm-build-4.14.1-10.16.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4064
    P
    		libtidy-0_99-0-1.0.20100204cvs-26.2.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3928
    P
    		lib3ds-1-3-1.3.0-25.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1862
    P
    		glibc-devel-32bit-2.26-13.48.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1847
    P
    		bouncycastle-1.64-1.63 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3858
    P
    		avahi-compat-howl-devel-0.6.32-32.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4012
    P
    		libmwaw-devel-0.3.14-7.12.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3840
    P
    		DirectFB-devel-1.7.1-6.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4720
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:50941
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50379
    P
    		Security update for openssh (Important)
    2020-12-01
    oval:org.opensuse.security:def:73998
    P
    		Security update for bluez (Important)
    2020-12-01
    oval:org.opensuse.security:def:64940
    P
    		Security update for Mesa (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63719
    P
    		Security update for netpbm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:74121
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49289
    P
    		pam_ssh on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:53085
    P
    		Security update for rmt-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:51809
    P
    		Security update for python-Flask (Low)
    2020-12-01
    oval:org.opensuse.security:def:50906
    P
    		Security update for bluez (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:53151
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:70676
    P
    		Security update for u-boot (Important)
    2020-12-01
    oval:org.opensuse.security:def:64424
    P
    		opie-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49505
    P
    		colord-color-profiles on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50511
    P
    		Security update for libxml2 (Low)
    2020-12-01
    oval:org.opensuse.security:def:51444
    P
    		Security update for git (Important)
    2020-12-01
    oval:org.opensuse.security:def:50357
    P
    		Security update for libnettle (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:74882
    P
    		Security update for uftpd (Important)
    2020-12-01
    oval:org.opensuse.security:def:63866
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:49536
    P
    		libXinerama1-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49375
    P
    		docker-libnetwork on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:75015
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50358
    P
    		Security update for bluez (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:51010
    P
    		Security update for tcpdump (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49068
    P
    		collectd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50743
    P
    		Security update for libbsd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:67430
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50884
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:64095
    P
    		Security update for u-boot (Important)
    2020-12-01
    oval:org.opensuse.security:def:49608
    P
    		MozillaFirefox on GA media (Moderate)
    2020-12-01
    oval:com.redhat.rhea:def:20204505
    P
    		RHEA-2020:4505: python-rtslib bug fix and enhancement update (Moderate)
    2020-11-04
    oval:org.opensuse.security:def:110710
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-08-07
    oval:org.opensuse.security:def:117268
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-08-03
    oval:org.opensuse.security:def:95918
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-08-03
    oval:org.opensuse.security:def:107753
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-08-03
    oval:org.opensuse.security:def:76508
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-08-03
    oval:org.opensuse.security:def:118388
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-08-03
    oval:org.opensuse.security:def:109297
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-08-03
    oval:org.opensuse.security:def:102631
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-08-03
    BACK
    rtslib-fb_project rtslib-fb *