id: PYSEC-2020-250
details: Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json
  because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are
  not preserved.
affected:
- package:
    name: rtslib-fb
    ecosystem: PyPI
    purl: pkg:pypi/rtslib-fb
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.1.73
  versions:
  - 2.1.31
  - 2.1.32
  - 2.1.35
  - 2.1.36
  - 2.1.37
  - 2.1.38
  - 2.1.39
  - 2.1.40
  - 2.1.43
  - 2.1.47
  - 2.1.49
  - 2.1.51
  - 2.1.56
  - 2.1.57
  - 2.1.58
  - 2.1.61
  - 2.1.62
  - 2.1.63
  - 2.1.64
  - 2.1.65
  - 2.1.66
  - 2.1.69
  - 2.1.71
  - 2.1.72
references:
- type: WEB
  url: https://github.com/open-iscsi/rtslib-fb/pull/162
- type: WEB
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNMCV2DJJTX345YYBXAMJBXNNVUZQ5UH/
- type: WEB
  url: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00012.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-cpcw-p965-wpqx
aliases:
- CVE-2020-14019
- GHSA-cpcw-p965-wpqx
modified: "2021-08-27T03:22:19.931800Z"
published: "2020-06-19T11:15:00Z"