Description
Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | 3.2.4-1 | — |
| Debian 7 | puppet | 2.7.23-1~deb7u1 | DSA-2761-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 3 | facter | 1.6.6-1.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | hiera | 1.0.0-3.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | puppet +1 | 3.2.4-1.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | ruby-augeas | 0.4.1-1.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | ruby-shadow | 1.4.1-13.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | ruby193-puppet +1 | 3.1.1-11.1.el6ost | RHSA-2013:1284 |
Advisories 3
- RHSA-2013:1284 Red Hat Security Advisory: ruby193-puppet security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:1283 Red Hat Security Advisory: puppet security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2761-1 puppet - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-2761 vendor-advisory
- http://puppetlabs.com/security/cve/cve-2013-4956/
- RHSA-2013:1284 vendor-advisory
- RHSA-2013:1283 vendor-advisory