Alerts This Week
Warning Icon 1 541
Alerts This Week
Warning Icon 1 541

Mageia: 2020-0434 moderate: python-xmlparser security flaw

mageia
Calendar Grey August 18, 2020
Dist Mageia Esm H88
Recent updates to the python-rstlib packages address inadequate permissions in Mageia, bolstering overall system reliability and protection.
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used and thus permissions are not prese...

Summary

Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used and thus permissions are not preserved upon editing. An adversary with prior access to /etc/target/saveconfig.json could access a later version, resulting in a loss of integrity depending on their permission settings (CVE-2020-14019).

References

- https://bugs.mageia.org/show_bug.cgi?id=27042

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TNMCV2DJJTX345YYBXAMJBXNNVUZQ5UH/

- https://www.cve.org/CVERecord?id=CVE-2020-14019

Resolution

SRPMS

- 7/core/python-rtslib-2.1.73-1.mga7

Publication date: 18 Aug 2020
URL: https://advisories.mageia.org/MGASA-2020-0336.html
Type: security
CVE: CVE-2020-14019

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here