| Package | Affected versions | Patched versions |
|---|---|---|
| puppet | ≥ 2.6, < 2.6.15≥ 2.7, < 2.7.13 | 2.6.152.7.13 |
| puppet | = 2.6.0= 2.6.1= 2.6.10= 2.6.11= 2.6.12= 2.6.13= 2.6.14= 2.6.2= 2.6.3= 2.6.4= 2.6.5= 2.6.6= 2.6.7= 2.6.8= 2.6.9= 2.7.10= 2.7.11= 2.7.2= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.7.9 | |
| puppet enterprise | = 1.2.0= 1.2.1= 1.2.2= 1.2.3= 1.2.4= 2.0.0= 2.0.1= 2.0.2= 2.5.0 | |
| puppet | = 2.7.0= 2.7.1 | |
| puppet enterprise users | = 1.0= 1.1 |
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free