Lucene search

K

GoogleOSV:GHSA-8JXJ-9R5F-W3M2

HistoryOct 24, 2017 - 6:33 p.m.

Puppet allows local users to obtain sensitive configuration information

2017-10-2418:33:37

Google

osv.dev

11

0.0004 Low

EPSS

Percentile

5.1%

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.

CPENameOperatorVersion
puppeteq2.7.12
puppeteq2.7.3
puppeteq2.7.5
puppeteq2.7.16
puppeteq2.7.9
puppeteq2.7.14
puppeteq2.7.11
puppeteq2.7.13
puppeteq2.7.1
puppeteq2.7.8

Rows per page:

1-10 of 131

References

lists.opensuse.org/opensuse-updates/2012-07/msg00036.html

puppetlabs.com/security/cve/cve-2012-3866

www.debian.org/security/2012/dsa-2511

www.ubuntu.com/usn/USN-1506-1

bugzilla.redhat.com/show_bug.cgi?id=839135

github.com/puppetlabs/puppet

github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f

github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3866.yml

nvd.nist.gov/vuln/detail/CVE-2012-3866

www.puppet.com/security/cve/cve-2012-3866-lastrunreportyaml-world-readable

0.0004 Low

EPSS

Percentile

5.1%

Related for OSV:GHSA-8JXJ-9R5F-W3M2

cve1 prion1 nvd1 github1 debiancve1 ubuntucve1 cvelist1 nessus6 openvas13 securityvulns2 freebsd1 amazon1 debian1 ubuntu1 osv1 fedora3