{"id":"GHSA-cpcw-p965-wpqx","summary":"rtslib-fb weak permissions for /etc/target/saveconfig.json file","details":"Python rtslib-fb through 2.1.72 has weak permissions for `/etc/target/saveconfig.json` because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.","aliases":["CVE-2020-14019","PYSEC-2020-250"],"modified":"2024-10-21T21:32:55.122605Z","published":"2022-05-24T17:21:16Z","database_specific":{"cwe_ids":["CWE-276"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-08-02T22:38:29Z","nvd_published_at":"2020-06-19T11:15:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14019"},{"type":"WEB","url":"https://github.com/open-iscsi/rtslib-fb/pull/162"},{"type":"WEB","url":"https://github.com/open-iscsi/rtslib-fb/commit/b23d061ee0fa7924d2cdce6194c313b9ee06c468"},{"type":"PACKAGE","url":"https://github.com/open-iscsi/rtslib-fb"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/rtslib-fb/PYSEC-2020-250.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNMCV2DJJTX345YYBXAMJBXNNVUZQ5UH"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00012.html"}],"affected":[{"package":{"name":"rtslib-fb","ecosystem":"PyPI","purl":"pkg:pypi/rtslib-fb"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.73"}]}],"versions":["2.1.31","2.1.32","2.1.35","2.1.36","2.1.37","2.1.38","2.1.39","2.1.40","2.1.43","2.1.47","2.1.49","2.1.51","2.1.56","2.1.57","2.1.58","2.1.61","2.1.62","2.1.63","2.1.64","2.1.65","2.1.66","2.1.69","2.1.71","2.1.72"],"database_specific":{"last_known_affected_version_range":"\u003c= 2.1.72","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cpcw-p965-wpqx/GHSA-cpcw-p965-wpqx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}