Description
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-rtslib-fb | 2.1.71-3 | — |
| Debian 13 | python-rtslib-fb | 2.1.71-3 | — |
| Debian 12 | python-rtslib-fb | 2.1.71-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | python-rtslib-fb | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | python-rtslib +2 | 2.1.73-2.el8 | RHEA-2020:4505 |
| RHEL 7 | python-rtslib +1 | 2.1.74-1.el7_9 | RHSA-2020:5435 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | python-rtslib-fb | 2.1.73-3.3.1 | SUSE-SU-2020:2109-1 |
| SLES 2 | python-rtslib-fb | 2.1.73-3.3.1 | SUSE-SU-2020:2109-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | python-rtslib-fb | 2.1.73-lp152.2.3.1 | openSUSE-SU-2020:1156-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python-rtslib +1 | 2.1.74-1.amzn2 | ALAS2-2021-1589 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-rtslib | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | python-rtslib +1 | 2.1.74-1.0.1.el7_9 | ELSA-2020-5435 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | rtslib-fb | < 2.1.73 | 2.1.73 | GHSA-cpcw-p965-wpqx |
Advisories 6
- RHSA-2020:5435 Red Hat Security Advisory: python-rtslib security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- SUSE-SU-2020:2109-1 Security update for python-rtslib-fb SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1156-1 Security update for python-rtslib-fb SUSE / openSUSE Security Updates · Feb 4, 2026
- RHEA-2020:4505 Red Hat Enhancement Advisory: python-rtslib bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ALAS2-2021-1589 Moderate: python-rtslib security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 26, 2021
- ELSA-2020-5435 Moderate: python-rtslib security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 16, 2020
References
- https://github.com/open-iscsi/rtslib-fb/pull/162
- FEDORA-2020-46ec9e748b vendor-advisory
- openSUSE-SU-2020:1156 vendor-advisory