Bug 1245189 - rear: Insecure temporary file usage
Summary: rear: Insecure temporary file usage
Keywords:
Status: CLOSED DUPLICATE of bug 1239009
Alias: None
Product: Fedora
Classification: Fedora
Component: rear
Version: 22
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Gratien D'haese
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 1238843
Blocks: 1221181 1239009
TreeView+ depends on / blocked
 
Reported: 2015-07-21 12:30 UTC by Petr Hracek
Modified: 2015-07-24 10:38 UTC (History)
4 users (show)

Fixed In Version: 1.17.2
Doc Type: Bug Fix
Doc Text:
Clone Of: 1238843
Environment:
Last Closed: 2015-07-24 10:38:05 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Petr Hracek 2015-07-21 12:30:13 UTC
+++ This bug was initially created as a clone of Bug #1238843 +++

Simply grepping for /tmp in source code gives a lot of hits, some of which are dangerous, e.g.:

usr/share/rear/verify/DP/default/50_select_dp_restore.sh:

test -f /tmp/dp_list_of_sessions.in && rm -f /tmp/dp_list_of_sessions.in

Would be nice if all occurences of hardcoded /tmp/.. were replaced with using mktemp.

Filed upstream https://github.com/rear/rear/issues/607

--- Additional comment from RHEL Product and Program Management on 2015-07-02 15:27:41 EDT ---

Since this bug report was entered in bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Comment 1 Gratien D'haese 2015-07-24 10:23:45 UTC
The needed changes were done and we will make an intermediate release of rear-1.17.2

Comment 2 Ján Rusnačko 2015-07-24 10:32:59 UTC
I think this one was cloned by mistake - I don`t see how it`s different from bz#1239009, from which it was cloned, as both are targeted to Fedora 22. 

Petr, do you think this could be closed duplicate ?

Comment 3 Petr Hracek 2015-07-24 10:38:05 UTC
You are right. I have missed it.

*** This bug has been marked as a duplicate of bug 1239009 ***


Note You need to log in before you can comment on or make changes to this bug.