LOW

GHSA-j436-h7hm-rx46

Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata

Quick fix

GHSA-j436-h7hm-rx46 — facter: upgrade to the fixed version with the command below.

bundle update facter

Details

Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/facter

Introduced in: 1.6.0Fixed in: 2.4.1

Fixbundle update facter

References

https://nvd.nist.gov/vuln/detail/CVE-2015-1426[ADVISORY]
https://github.com/puppetlabs/facter[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/facter/CVE-2015-1426.yml[WEB]
https://web.archive.org/web/20150906195742/http://puppetlabs.com/security/cve/cve-2015-1426[WEB]
https://www.puppet.com/security/cve/cve-2015-1426-potential-sensitive-information-leakage-facters-amazon-ec2-metadata[WEB]