GitHub Advisoryadvisory · RubyGems

GHSA-mpmx-gm5v-q789 Puppet uses predictable filenames, allowing arbitrary file overwrite

MEDIUM Published 2022-05-14 Modified 2024-01-16 Official page ↗
Aliases
CVE-2011-3871
Ecosystem
RubyGems
Packages
puppet
Severity
Moderate
Weaknesses
CWE-340
Reviewed
2024-01-16

Affected packages

• RubyGems puppet: >= 2.7.0, < 2.7.5 → fixed in 2.7.5 • RubyGems puppet: < 2.6.11 → fixed in 2.6.11

Description

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in `--edit` mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.

Related

Alias · CVE (1)

  • CVE-2011-3871 Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local… vulnerability

Weakness · CWE (1)

  • CWE-340 Generation of Predictable Numbers or Identifiers weakness

References