Summary
It was discovered that Puppet incorrectly handled permissions when
unpacking certain tarballs. A local user could possibly use this issue to
execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | puppet | 3.4.3-1ubuntu1.3 |
Vulnerabilities 1
-
Medium 5.5
Tarball permission preservation in puppet
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.
References
-
report
https://ubuntu.com/security/CVE-2017-10689