Summary
It was discovered that targetcli-fb did not properly manage socket
permissions. A local attacker could use this issue to modify the iSCSI
configuration resulting in a denial of service, obtain sensitive
information or execute arbitrary code. (CVE-2020-10699)
It was discovered that targetcli-fb did not properly manage permissions for
/etc/target and underneath backup directory/files. An attacker could use
this issue to access sensitive information. (CVE-2020-13867)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | targetcli-fb | 1:2.1.51-0ubuntu1+esm1 |
Vulnerabilities 2
-
High 7.8
A flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-wri…
-
Unscored —
Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup fi…