https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 05:08:44 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-125672 <p>A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl&#39;s argument vector without a &#34;--&#34; separator. An address beginning with &#34;-&#34; is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device&#39;s Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.</p> <p>A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl&#39;s argument vector without a &#34;--&#34; separator. An address beginning with &#34;-&#34; is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device&#39;s Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.</p> https://db.gcve.eu/vuln/fkie_cve-2026-125672 https://db.gcve.eu/vuln/ghsa-7vw6-56j5-6r97 <p>A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl&#39;s argument vector without a &#34;--&#34; separator. An address beginning with &#34;-&#34; is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device&#39;s Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.</p> <p>A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl&#39;s argument vector without a &#34;--&#34; separator. An address beginning with &#34;-&#34; is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device&#39;s Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.</p> https://db.gcve.eu/vuln/ghsa-7vw6-56j5-6r97