Description
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | 2.7.18-1 | — |
| Debian 6.0 | puppet | 2.6.2-5+squeeze6 | DSA-2511-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puppet | < 2.6.17 | 2.6.17 | GHSA-g89m-3wjw-h857 |
| RubyGems | puppet | >= 2.7.0, < 2.7.18 | 2.7.18 | GHSA-g89m-3wjw-h857 |
Advisories 1
- DSA-2511-1 puppet - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SU-2012:0983 vendor-advisory
- https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f
- DSA-2511 vendor-advisory
- USN-1506-1 vendor-advisory
- 50014 third-party-advisory
- openSUSE-SU-2012:0891 vendor-advisory
- https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6
- https://bugzilla.redhat.com/show_bug.cgi?id=839131
- http://puppetlabs.com/security/cve/cve-2012-3865/