CVE-2020-13867: 
NixOS vulnerability analysis and mitigation

CVE-2020-13867 affects Open-iSCSI targetcli-fb through version 2.1.52, involving weak permissions for /etc/target directory, its backup directory, and backup files. The vulnerability was discovered and disclosed in June 2020, impacting various Linux distributions including Red Hat Enterprise Linux, Fedora, openSUSE, Ubuntu, and Gentoo that use the targetcli-fb package for managing iSCSI, FCoE, and other SCSI targets (NVD, Red Hat).

The vulnerability is characterized by incorrect default permissions (CWE-276) in the targetcli-fb package. The CVSS v3.1 base score is 5.5 (MEDIUM) with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local access is required. The CVSS v2.0 base score is 2.1 (LOW) with a vector of AV:L/AC:L/Au:N/C:P/I:N/A:N (NVD).

The vulnerability allows local users to access sensitive information due to world-readable permissions on the /etc/target directory and its backup files. This could potentially expose configuration details and other sensitive data stored in these locations (Ubuntu, Red Hat).

The vulnerability requires local access to the system to be exploited. No known active exploits have been reported in the wild. The attack complexity is low, requiring minimal conditions to be exploited (NVD).

The vulnerability was fixed in targetcli-fb version 2.1.53 by implementing proper permission settings for the /etc/target directory and backup files. Users are advised to upgrade to this version or later. Various Linux distributions have released security updates to address this issue (Gentoo, OpenSUSE, Fedora).