MEDIUM

GHSA-c4mc-49hq-q275

Puppet uses predictable filenames, allowing arbitrary file overwrite

Quick fix

GHSA-c4mc-49hq-q275 — puppet: upgrade to the fixed version with the command below.

bundle update puppet

Details

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/puppet

Introduced in: 2.6Fixed in: 2.6.15

Fixbundle update puppet

RubyGems/puppet

Introduced in: 2.7Fixed in: 2.7.13

Fixbundle update puppet

References

https://nvd.nist.gov/vuln/detail/CVE-2012-1906[ADVISORY]
https://github.com/puppetlabs/puppet/commit/f7829ec1f1b2c3def8e0eda09c22c3c1fed3a27f[WEB]
https://exchange.xforce.ibmcloud.com/vulnerabilities/74793[WEB]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1906.yml[WEB]
https://ubuntu.com/usn/usn-1419-1[WEB]
https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975[WEB]
https://www.debian.org/security/2012/dsa-2451[WEB]
http://projects.puppetlabs.com/issues/13260[WEB]
http://puppetlabs.com/security/cve/cve-2012-1906[WEB]