Description
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | 2.7.11-1 | — |
| Debian 6.0 | puppet | 2.6.2-5+squeeze4 | DSA-2419-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puppet | >= 2.6, < 2.6.14 | 2.6.14 | GHSA-77hg-g8cc-5r37 |
| RubyGems | puppet | >= 2.7, < 2.7.11 | 2.7.11 | GHSA-77hg-g8cc-5r37 |
Advisories 1
- DSA-2419-1 puppet - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 48157 third-party-advisory
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14
- 48166 third-party-advisory
- http://projects.puppetlabs.com/issues/12458
- http://puppetlabs.com/security/cve/cve-2012-1053/
- http://projects.puppetlabs.com/issues/12459
- USN-1372-1 vendor-advisory
- 48290 third-party-advisory
- 79495 vdb-entry
- 48161 third-party-advisory
- http://projects.puppetlabs.com/issues/12457
- SUSE-SU-2012:0325 vendor-advisory
- puppet-forked-priv-escalation(73445) vdb-entry
- 52158 vdb-entry
- DSA-2419 vendor-advisory
- openSUSE-SU-2012:0835 vendor-advisory