Description
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | 2.6.2-3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puppet | >= 2.6.0, < 2.6.4 | 2.6.4 | GHSA-9pvx-fwwh-w289 |
References
- USN-1365-1 vendor-advisory
- [oss-security] 20110127 CVE request: puppet mailing-list
- [puppet-users] 20101201 SECURITY: Authorization vulnerability in Puppet 2.6.x mailing-list
- [oss-security] 20110127 Re: CVE request: puppet mailing-list