Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 09 Sep 2014 00:46:22 -0600
From: Kurt Seifried <>
To: "" <>,
        Assign a CVE Identifier <>,
        Trevor Jay <>
Subject: headintheclouds tmp vulns - also request for referees decision on
 tmp vulns in deployment tools

So in theory this is software is used for docker provisioning thing, so
there shouldn't be any users on the docker image while it's being
deployed (or indeed any software pretty much at all), so part of me
wants to say this shouldn't qualify for a CVE if used normally, however
it is a pretty blatant tmp vuln. So for the sake of starting a
conversation about tmp vulns on systems that shouldn't have any users or
ways to exploit the tmp vuln I'm posting this one. Basically if a tree
falls in the forest but no beavers were present does anyone care that a
lumber jack might get squashed?

    remote_scripts_directory = '/tmp/bootstrap_scripts'
    sudo('mkdir -p %s' % remote_scripts_directory)
    for path in sorted(scripts):
        filename = os.path.basename(path)
        remote_script = '%s/%s' % (remote_scripts_directory, filename)
        put('bootstrap/%s' % filename, remote_script, use_sudo=True)
        run('source %s' % remote_script)

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.