Re: CVE Request -- fabric -- Use of insecure temporary file by uploading templates and projects to remote hosts

[Josh Bressers <bressers () redhat com>]

----- Original Message -----
> Hello, Josh, Steve, vendors,
>
> It was found that fabric, a simple Pythonic remote deployment tool,
> used insecure way for creation of temporary files, when uploading
> template text files and project files to a remote system. A local
> attacker could use this flaw to conduct symlink attacks to upload
> sensitive information to remote host or to overwrite certain local
> system files.
>
> References:
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629003
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=710462

Please use CVE-2011-2185.

Thanks.

-- 
    JB