GitHub Advisoryadvisory · RubyGems

GHSA-8c56-v25w-f89c Puppet arbitrary file overwrite

MEDIUM Published 2022-05-14 Modified 2024-01-16 Official page ↗
Aliases
CVE-2011-3869
Ecosystem
RubyGems
Packages
puppet
Severity
Moderate
Weaknesses
CWE-59
Reviewed
2024-01-16

Affected packages

• RubyGems puppet: >= 2.7.0, < 2.7.5 → fixed in 2.7.5 • RubyGems puppet: < 2.6.11 → fixed in 2.6.11

Description

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.

Related

Alias · CVE (1)

  • CVE-2011-3869 Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References