GitHub Advisoryadvisory · RubyGems
GHSA-vw22-465p-8j5w Tarball permission preservation in puppet
MEDIUM
Official page ↗
- Aliases
- CVE-2017-10689
- Ecosystem
- RubyGems
- Packages
- puppet
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-269
- Reviewed
- 2022-07-21
Affected packages
• RubyGems puppet: < 4.10.10 → fixed in 4.10.10
• RubyGems puppet: >= 5.0.0, < 5.3.4 → fixed in 5.3.4
Description
When installing a module using the system tar, the PMT will filter filesystem permissions to a sane value. This may just be based on the user's umask.
When using minitar, files are unpacked with whatever permissions are in the tarball. This is potentially unsafe, as tarballs can be easily created with weird permissions.
Related
Alias · CVE (1)
- CVE-2017-10689 In previous versions of Puppet Agent it was possible to install a module with world writable permissions. vulnerability
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-10689 advisory
- https://github.com/puppetlabs/puppet/commit/17d9e02da3882e44c1876e2805cf9708481715ee web
- https://github.com/puppetlabs/puppet/commit/2f1047f85e22cde139a421bc25d371f2ffc92cb1 web
- https://access.redhat.com/errata/RHSA-2018:2927 web
- https://github.com/puppetlabs/puppet package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2017-10689.yml web
- https://puppet.com/security/cve/CVE-2017-10689 web
- https://tickets.puppetlabs.com/browse/PUP-7866 web
- https://usn.ubuntu.com/3567-1 web