Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for
/etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is
used and thus permissions are not preserved upon editing. An adversary with
prior access to /etc/target/saveconfig.json could access a later version,
resulting in a loss of integrity depending on their permission settings
(CVE-2020-14019).
- https://bugs.mageia.org/show_bug.cgi?id=27042
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TNMCV2DJJTX345YYBXAMJBXNNVUZQ5UH/
- https://www.cve.org/CVERecord?id=CVE-2020-14019
- 7/core/python-rtslib-2.1.73-1.mga7
Get the latest Linux and open source security news straight to your inbox.