GitHub Advisoryadvisory · RubyGems

GHSA-qh3g-27jf-3j54 Puppet allows local users to modify the permissions of arbitrary files

MEDIUM Published 2022-05-14 Modified 2024-01-16 Official page ↗
Aliases
CVE-2011-3870
Ecosystem
RubyGems
Packages
puppet
Severity
Moderate
Weaknesses
CWE-59
Reviewed
2024-01-16

Affected packages

• RubyGems puppet: >= 2.7.0, < 2.7.5 → fixed in 2.7.5 • RubyGems puppet: < 2.6.11 → fixed in 2.6.11

Description

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.

Related

Alias · CVE (1)

  • CVE-2011-3870 Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References