MEDIUM

GHSA-77hg-g8cc-5r37

Puppet Privilege Escallation

Quick fix

GHSA-77hg-g8cc-5r37 — puppet: upgrade to the fixed version with the command below.

bundle update puppet

Details

The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/puppet

Introduced in: 2.6Fixed in: 2.6.14

Fixbundle update puppet

RubyGems/puppet

Introduced in: 2.7Fixed in: 2.7.11

Fixbundle update puppet

References

https://nvd.nist.gov/vuln/detail/CVE-2012-1053[ADVISORY]
https://github.com/puppetlabs/puppet/commit/76d0749f0a9a496b70e7dc7e6d6d6ff692224e36[WEB]
https://exchange.xforce.ibmcloud.com/vulnerabilities/73445[WEB]
https://ubuntu.com/usn/usn-1372-1[WEB]
https://web.archive.org/web/20120504011717/http://puppetlabs.com/security/cve/cve-2012-1053[WEB]
https://web.archive.org/web/20120513215447/http://projects.puppetlabs.com/issues/12458[WEB]
https://web.archive.org/web/20120513215653/http://projects.puppetlabs.com/issues/12457[WEB]
https://web.archive.org/web/20120513223437/http://projects.puppetlabs.com/issues/12459[WEB]
https://web.archive.org/web/20120527071855/http://www.securityfocus.com/bid/52158[WEB]
https://web.archive.org/web/20120816020421/http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14[WEB]
https://www.debian.org/security/2012/dsa-2419[WEB]