CVE-2020-14019

Name of the Vulnerable Software and Affected Versions Open-iSCSI rtslib-fb versions 2.1.72 and earlier

Description The issue is related to weak permissions for the /etc/target/saveconfig.json file due to the use of shutil.copyfile instead of shutil.copy, resulting in permissions not being preserved. This could potentially allow an attacker to execute arbitrary code by sending specially crafted data to the application.

Recommendations For Open-iSCSI rtslib-fb versions 2.1.72 and earlier, consider updating to a version where the issue is fixed, or as a temporary workaround, manually correct the permissions of the /etc/target/saveconfig.json file to prevent exploitation. Additionally, restrict access to the /etc/target/saveconfig.json file to minimize the risk of exploitation.