GHSA-8c56-v25w-f89c

Suggest an improvement
Source
https://github.com/advisories/GHSA-8c56-v25w-f89c
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8c56-v25w-f89c/GHSA-8c56-v25w-f89c.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-8c56-v25w-f89c
Aliases
Published
2022-05-14T00:56:54Z
Modified
2024-12-02T05:35:44.743596Z
Summary
Puppet arbitrary file overwrite
Details

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.

Database specific 
{
    "github_reviewed_at": "2024-01-16T21:31:04Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-59"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2011-10-27T20:55:00Z"
}
References

Affected packages

RubyGems / puppet

Package

Name
puppet
Purl
pkg:gem/puppet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.7.0
Fixed
2.7.5

Affected versions

2.*

2.7.1
2.7.3
2.7.4

RubyGems / puppet

Package

Name
puppet
Purl
pkg:gem/puppet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.11

Affected versions

0.*

0.9.2
0.13.0
0.13.1
0.13.2
0.13.6
0.16.0
0.18.4
0.22.4
0.23.0
0.23.1
0.23.2
0.24.0
0.24.1
0.24.2
0.24.3
0.24.4
0.24.5
0.24.6
0.24.7
0.24.8
0.24.9
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5

2.*

2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.6.10