GitHub Advisoryadvisory · RubyGems

GHSA-vrh7-99jh-3fmm Puppet arbitrary files overwrite via a symlink attack

LOW Published 2022-05-02 Modified 2024-02-06 Official page ↗
Aliases
CVE-2010-0156
Ecosystem
RubyGems
Packages
puppet
Severity
Low
Weaknesses
CWE-59
Reviewed
2024-02-06

Affected packages

• RubyGems puppet: >= 0.24.0, < 0.24.9 → fixed in 0.24.9 • RubyGems puppet: >= 0.25.0, < 0.25.2 → fixed in 0.25.2

Description

Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.

Related

Alias · CVE (1)

  • CVE-2010-0156 Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1)… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References