CVE catalog

CVE-2020-13867

targetcli-fb: CVE-2020-13867

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantargetcli-fbsid1:3.0.2-2fixed
Debiantargetcli-fbforky1:3.0.2-2fixed
Debiantargetcli-fbtrixie1:2.1.53-1.3fixed
Debiantargetcli-fbbookworm1:2.1.53-1.1fixed
Opensusetargetcli-fbleap 15.22.1.52-lp152.2.3.1fixed
Opensusetargetcli-fbleap 15.12.1.49-lp151.2.10.1fixed
Ubuntutargetcli-fbpro2.1.fb49-1vulnerable
Ubuntutargetcli-fbpro1:2.1.51-0ubuntu1vulnerable
Ubuntutargetcli-fbpro1:2.1.51-0ubuntu1+esm1fixed
Susetargetcli-fblinux enterprise server 12 sp52.1.43-7.9.4fixed
Susetargetcli-fblinux enterprise server for sap applications 12 sp52.1.43-7.9.4fixed
Susetargetcli-fblinux enterprise module for basesystem 15 sp22.1.52-3.3.1fixed
Susetargetcli-fblinux enterprise module for python 2 15 sp22.1.52-3.3.1fixed
Susetargetcli-fblinux enterprise module for basesystem 15 sp12.1.49-10.9.1fixed
Susetargetcli-fblinux enterprise module for python 2 15 sp12.1.49-10.9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantargetcli-fbsourcesid1:2.1.53-1lowNot reported[962331]
Debiantargetcli-fbsourceforky1:2.1.53-1lowNot reported[962331]
Debiantargetcli-fbsourcetrixie1:2.1.53-1lowNot reported[962331]
Debiantargetcli-fbsourcebookworm1:2.1.53-1lowNot reported[962331]
Opensusetargetcli-fbrpmleap 15.22.1.52-lp152.2.3.1Not reportedOPENSUSE-SU-2020:1144-1Not reported
Opensusetargetcli-fbrpmleap 15.12.1.49-lp151.2.10.1Not reportedOPENSUSE-SU-2020:1141-1Not reported
Ubuntutargetcli-fbdebpro1:2.1.51-0ubuntu1+esm1Not reportedUBUNTU-CVE-2020-13867Not reported
Susetargetcli-fbrpmlinux enterprise server 12 sp52.1.43-7.9.4Not reportedSUSE-SU-2020:2360-1Not reported
Susetargetcli-fbrpmlinux enterprise server for sap applications 12 sp52.1.43-7.9.4Not reportedSUSE-SU-2020:2360-1Not reported
Susetargetcli-fbrpmlinux enterprise module for basesystem 15 sp22.1.52-3.3.1Not reportedSUSE-SU-2020:2101-1Not reported
Susetargetcli-fbrpmlinux enterprise module for python 2 15 sp22.1.52-3.3.1Not reportedSUSE-SU-2020:2101-1Not reported
Susetargetcli-fbrpmlinux enterprise module for basesystem 15 sp12.1.49-10.9.1Not reportedSUSE-SU-2020:2086-1Not reported
Susetargetcli-fbrpmlinux enterprise module for python 2 15 sp12.1.49-10.9.1Not reportedSUSE-SU-2020:2086-1Not reported

[Debian bug #962331]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [targetcli-fb]Fixed
    Details (2)

    • 1:2.1.53-1.1 · all · bookworm

      Fixed · Fixed: 1:2.1.53-1

      dsa · targetcli-fb · debian · bookworm; dsa · targetcli-fb · debian · 12

    • 1:2.1.53-1.1 · all · bookworm

      Fixed · Fixed: 1:2.1.53-1

      dsa · targetcli-fb · debian · bookworm; dsa · targetcli-fb · debian · 12

[Debian 13 (Trixie)]

  • [targetcli-fb]Fixed
    Details (2)

    • 1:2.1.53-1.3 · all · trixie

      Fixed · Fixed: 1:2.1.53-1

      dsa · targetcli-fb · debian · 13

    • 1:2.1.53-1.3 · all · trixie

      Fixed · Fixed: 1:2.1.53-1

      dsa · targetcli-fb · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]