| Package | Affected versions | Patched versions |
|---|---|---|
| puppet | ≥ 2.7.0, < 2.7.5< 2.6.11 | 2.7.52.6.11 |
| puppet | = 0.25.0= 0.25.1= 0.25.2= 0.25.3= 0.25.4= 0.25.5= 0.25.6= 2.6.0= 2.6.1= 2.6.10= 2.6.2= 2.6.3= 2.6.4= 2.6.5= 2.6.6= 2.6.7= 2.6.8= 2.6.9= 2.7.2= 2.7.3= 2.7.4 | |
| puppet | = 2.7.0= 2.7.1 |
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free