Permissions, Privileges, and Access Controls in rtslib-fb - CVE-2020-14019

Vulnerability identifier: #VU29286

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14019

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions for "/etc/target/saveconfig.json" when "shutil.copyfile" being used, instead of "shutil.copy". A remote attacker can gain elevated privileges on the target system.

rtslib-fb
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
CentOS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Opensuse
Fedora
python-rtslib
python-rtslib (Red Hat package)

Install updates from vendor's website.

rtslib-fb - update to 2.1.73
python-rtslib - update to 2.1.73-1.fc32
python-rtslib (Red Hat package) - addressed in versions 2.1.73-2.el8, 2.1.74-1.el7_9

• https://github.com/open-iscsi/rtslib-fb/pull/162

• Privilege escalation in Open-iSCSI rtslib-fb library
• OpenSUSE Linux update for python-rtslib-fb
• Red Hat Enterprise Linux 8 update for python-rtslib
• Red Hat Enterprise Linux 7 update for python-rtslib
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• CentOS 7 update for python-rtslib
• Fedora 32 update for python-rtslib