Steve Kemp reported two temporary file issues in pen, a load balancer for "simple" TCP based protocols such as HTTP and SMTP.
The first is the use of "/tmp/webfile.html" when requesting web stats.
The second is the use of "/tmp/penctl.cgi" in the penctl.cgi CGI script.
A local attacker could use these flaws to perform symbolic link attacks.
Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741370
CVE request: http://seclists.org/oss-sec/2014/q1/566
Created pen tracking bugs for this issue:
Affects: fedora-all [bug 1076050]
Affects: epel-all [bug 1076051]
MITRE assigned CVE-2014-2387 to these issues:
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.