22 Aug
2026
22 Aug
'26
10:29 a.m.
On Fri, Aug 21, 2026 at 7:28 PM Stephan Hohn <ceph-users@ceph.io> wrote:
podman run --privileged --entrypoint /tmp/cryptsetup_action.sh \ -v /tmp/cephadm-osd-14-rotate-helper.sh:/tmp/cryptsetup_action.sh <image>
Hey, isn't this (the use of a predictably named file in /tmp, that the adversary can pre-create, e.g., as a symlink to something else) a vulnerability by itself? -- Alexander Patrakov