CVE-2020-14019: 
Python vulnerability analysis and mitigation

CVE-2020-14019 affects Open-iSCSI rtslib-fb through version 2.1.72. The vulnerability was discovered in June 2020 and involves weak permissions for the /etc/target/saveconfig.json file due to the use of shutil.copyfile instead of shutil.copy, which does not preserve file permissions (NVD).

The vulnerability stems from improper file permission handling in the rtslib-fb package. When saving configuration files, the code uses shutil.copyfile() instead of shutil.copy(), which fails to preserve the intended file permissions. This results in the /etc/target/saveconfig.json file having overly permissive default permissions instead of the intended restricted access (GitHub PR). The vulnerability has a CVSS v3.1 Base Score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The weak file permissions on /etc/target/saveconfig.json could allow unauthorized access to sensitive configuration data. The file permissions are set to world-readable (-rw-r--r--) instead of the intended restricted access (-rw-------), potentially exposing system configuration information (GitHub PR).

The vulnerability requires local access to the system to exploit. An attacker with local access could read sensitive configuration information from the affected file due to the overly permissive file permissions (NVD).

The vulnerability was fixed in rtslib-fb version 2.1.73 by changing the file copy operation from shutil.copyfile() to shutil.copy() to properly preserve file permissions. Users should upgrade to version 2.1.73 or later to address this vulnerability (OpenSUSE, Red Hat).