CVE-2020-14019
rtslib-fb weak permissions for /etc/target/saveconfig.json file
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
CVE-2020-14019- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-276
- Updated
- 2026-11-02
CVE List No score
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
CVE-2020-14019- Updated
- 2026-11-02
EUVDEUVD-2020-0169 No score
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
EUVD-2020-0169- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cpcw-p965-wpqx
rtslib-fb weak permissions for /etc/target/saveconfig.json file
Python rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
GHSA-cpcw-p965-wpqx- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
OSVAZL-44778
CVE-2020-14019 affecting package python-rtslib 2.1.fb69-9
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
AZL-44778- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
CVE-2020-14019- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2020-14019
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
DEBIAN-CVE-2020-14019- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-cpcw-p965-wpqx
rtslib-fb weak permissions for /etc/target/saveconfig.json file
Python rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
GHSA-cpcw-p965-wpqx- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
OSVRHEA-2020:4505
Red Hat Enhancement Advisory: python-rtslib bug fix and enhancement update
- Record
RHEA-2020:4505- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2020:5435
Red Hat Security Advisory: python-rtslib security update
- Record
RHSA-2020:5435- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-14019
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
UBUNTU-CVE-2020-14019- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0336 No score
Updated python-rstlib packages fix security vulnerability
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used and thus permissions are not preserved upon editing. An adversary with prior access to /etc/target/saveconfig.json could access a later version, resulting in a loss of integrity depending on their permission settings (CVE-2020-14019).
- Record
MGASA-2020-0336- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1156-1 No score
Security update for python-rtslib-fb
This update for python-rtslib-fb fixes the following issues:
- Update to version v2.1.73 (bsc#1173257 CVE-2020-14019):
- version 2.1.73
- save_to_file: fix fd open mode
- saveconfig: copy temp configfile with permissions
- saveconfig: open the temp configfile with modes set
- Fix 'is not' with a literal SyntaxWarning
- Fix an incorrect config path in two comments
- version 2.1.72
- Do not change dbroot after drivers have been registered
- Remove '_if_needed' from RTSRoot._set_dbroot()'s name Replacing old tarball with python-rtslib-fb-v2.1.73.tar.xz
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2020:1156-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11270-1 No score
python-rtslib-fb-common-2.1.74-2.7 on GA media
These are all security issues fixed in the python-rtslib-fb-common-2.1.74-2.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11270-1- Updated
- 2026-11-02
OSVPYSEC-2020-250 No score
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
- Record
PYSEC-2020-250- Updated
- 2026-11-02
OSVSUSE-SU-2020:2109-1 No score
Security update for python-rtslib-fb
This update for python-rtslib-fb fixes the following issues:
- Update to version v2.1.73 (bsc#1173257 CVE-2020-14019):
- version 2.1.73
- save_to_file: fix fd open mode
- saveconfig: copy temp configfile with permissions
- saveconfig: open the temp configfile with modes set
- Fix 'is not' with a literal SyntaxWarning
- Fix an incorrect config path in two comments
- version 2.1.72
- Do not change dbroot after drivers have been registered
- Remove '_if_needed' from RTSRoot._set_dbroot()'s name Replacing old tarball with python-rtslib-fb-v2.1.73.tar.xz
- Record
SUSE-SU-2020:2109-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rtslib-fbPyPI |
through 2.1.72 | 2.1.73 |
python-rtslibAzure Linux:3 |
through 2.1.fb69-9 | None known |
python-rtslib-fbDebian:12 |
before 2.1.71-3 | 2.1.71-3 |
python-rtslib-fbDebian:13 |
before 2.1.71-3 | 2.1.71-3 |
python-rtslib-fbDebian:14 |
before 2.1.71-3 | 2.1.71-3 |
rtslib-fbPyPI |
before 2.1.73, plus listed versions 2.1.312.1.322.1.352.1.362.1.37 Show 19 moreShow less2.1.382.1.392.1.402.1.432.1.472.1.492.1.512.1.562.1.572.1.582.1.612.1.622.1.632.1.642.1.652.1.662.1.692.1.712.1.72 |
2.1.73 |
python-rtslibMageia:7 |
before 2.1.73-1.mga7 | 2.1.73-1.mga7 |
python-rtslibRed Hat:enterprise_linux:8::baseos |
before 0:2.1.73-2.el8 | 0:2.1.73-2.el8 |
python3-rtslibRed Hat:enterprise_linux:8::baseos |
before 0:2.1.73-2.el8 | 0:2.1.73-2.el8 |
target-restoreRed Hat:enterprise_linux:8::baseos |
before 0:2.1.73-2.el8 | 0:2.1.73-2.el8 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-rtslibRed Hat:enterprise_linux:7::client |
before 0:2.1.74-1.el7_9 | 0:2.1.74-1.el7_9 |
python-rtslib-docRed Hat:enterprise_linux:7::client |
before 0:2.1.74-1.el7_9 | 0:2.1.74-1.el7_9 |
python-rtslib-docRed Hat:enterprise_linux:7::computenode |
before 0:2.1.74-1.el7_9 | 0:2.1.74-1.el7_9 |
python-rtslibRed Hat:enterprise_linux:7::server |
before 0:2.1.74-1.el7_9 | 0:2.1.74-1.el7_9 |
python-rtslib-docRed Hat:enterprise_linux:7::server |
before 0:2.1.74-1.el7_9 | 0:2.1.74-1.el7_9 |
python-rtslibRed Hat:enterprise_linux:7::workstation |
before 0:2.1.74-1.el7_9 | 0:2.1.74-1.el7_9 |
python-rtslib-docRed Hat:enterprise_linux:7::workstation |
before 0:2.1.74-1.el7_9 | 0:2.1.74-1.el7_9 |
python-rtslib-fbSUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 2.1.73-3.3.1 | 2.1.73-3.3.1 |
python-rtslib-fbSUSE:Linux Enterprise Module for Python 2 15 SP2 |
before 2.1.73-3.3.1 | 2.1.73-3.3.1 |
python-rtslib-fbUbuntu:20.04:LTS |
All versions, plus listed versions 2.1.66-3.22.1.69-32.1.71-0ubuntu12.1.71-0ubuntu1.1 |
None known |
python-rtslib-fbopenSUSE:Leap 15.2 |
before 2.1.73-lp152.2.3.1 | 2.1.73-lp152.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-14019 is a high vulnerability (CVSS 7.8) in Rtslib-fb Project Rtslib-fb, published June 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in rtslib-fb 2.1.73.
References
github.com/open-iscsi/rtslib-fb/pull/162
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNMCV2DJJTX345YYBXAMJBXNNVUZQ5UH
lists.opensuse.org/opensuse-security-announce/2020-08/msg00012.html
nvd.nist.gov/vuln/detail/CVE-2020-14019
Show 24 moreShow less
security-tracker.debian.org/tracker/CVE-2020-14019
advisories.mageia.org/MGASA-2020-0336.html
bugs.mageia.org/show_bug.cgi?id=27042
access.redhat.com/errata/RHEA-2020:4505
bugzilla.redhat.com/show_bug.cgi?id=1820170
security.access.redhat.com/data/csaf/v2/advisories/2020/rhea-2020_4505.json
cve.org/CVERecord?id=CVE-2020-14019
suse.com/support/update/announcement/2020/suse-su-20202109-1
bugzilla.suse.com/1173257
ubuntu.com/security/CVE-2020-14019