CVE-2022-3275

2022-10-0700:00:00

ubuntu.com

command injection

puppetlabs-apt

version 9.0.0

malicious actor

unsanitized input

vulnerability exploit

rare condition

regression

github issue

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

73.2%

JSON

Command injection is possible in the puppetlabs-apt module prior to version
9.0.0. A malicious actor is able to exploit this vulnerability only if they
are able to provide unsanitized input to the module. This condition is rare
in most deployments of Puppet and Puppet Enterprise.

Notes

Author	Note
rodrigo-zaiden	possible regression on https://github.com/puppetlabs/puppetlabs-apt/issues/1057

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpuppet-module-puppetlabs-apt< anyUNKNOWN
ubuntu20.04noarchpuppet-module-puppetlabs-apt< anyUNKNOWN
ubuntu22.04noarchpuppet-module-puppetlabs-apt< anyUNKNOWN
ubuntu16.04noarchpuppet-module-puppetlabs-apt< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	puppet-module-puppetlabs-apt	< any	UNKNOWN
ubuntu	20.04	noarch	puppet-module-puppetlabs-apt	< any	UNKNOWN
ubuntu	22.04	noarch	puppet-module-puppetlabs-apt	< any	UNKNOWN
ubuntu	16.04	noarch	puppet-module-puppetlabs-apt	< any	UNKNOWN