Puppet uses predictable filenames, allowing arbitrary file overwrite

中 6.2CVE-2011-3871 · GHSA-mpmx-gm5v-q789 · 27/10/2011 公開 · 16/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
puppet RubyGems	`≥ 2.7.0, < 2.7.5< 2.6.11`	`2.7.52.6.11`
puppet puppet	`= 0.25.0= 0.25.1= 0.25.2= 0.25.3= 0.25.4= 0.25.5= 0.25.6= 2.6.0= 2.6.1= 2.6.10= 2.6.2= 2.6.3= 2.6.4= 2.6.5= 2.6.6= 2.6.7= 2.6.8= 2.6.9= 2.7.2= 2.7.3= 2.7.4`	修正版なし
puppet puppetlabs	`= 2.7.0= 2.7.1`	修正版なし

概要

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.

NVD の説明

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.

参考情報

nvd.nist.gov/vuln/detail/CVE-2011-3871 · ADVISORY
puppetlabs/puppet commit 343c7bd · WEB
puppetlabs/puppet commit d76c309 · WEB
puppetlabs/puppet · PACKAGE
rubysec/ruby-advisory-db · WEB
puppet.com/security/cve/cve-2011-3871 · WEB
groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb · WEB
lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html · WEB
debian.org/security/2011/dsa-2314 · WEB
ubuntu.com/usn/USN-1223-1 · WEB
ubuntu.com/usn/USN-1223-2 · WEB
secunia.com/advisories/46458 · Vendor Advisory

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン