GHSA-cpcw-p965-wpqx

rtslib-fb weak permissions for /etc/target/saveconfig.json file

Source: GitHub Advisory Database (reviewed) High CVE-2020-14019

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	rtslib-fb	< 2.1.73	2.1.73

Details

As written in the advisory (Markdown source, shown as plain text).

Python rtslib-fb through 2.1.72 has weak permissions for `/etc/target/saveconfig.json` because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-14019 advisory
https://github.com/open-iscsi/rtslib-fb/pull/162 web
https://github.com/open-iscsi/rtslib-fb/commit/b23d061ee0fa7924d2cdce6194c313b9ee06c468 web
https://github.com/open-iscsi/rtslib-fb package
https://github.com/pypa/advisory-database/tree/main/vulns/rtslib-fb/PYSEC-2020-250.yaml web
https://lists.fedoraproject.org/archives/list/[email protected]/message/TNMCV2DJJTX345YYBXAMJBXNNVUZQ5UH web
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00012.html web