The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade puppet | Jul 30, 2024 | May 29, 2012 |
| Gentoo Linux | — | Upgrade app-admin/puppet. | Oct 30, 2017 | May 29, 2012 |
| Suse | — | Upgrade puppetUpgrade puppet-server | Feb 17, 2015 | May 29, 2012 |
| Ubuntu | — | Upgrade puppet-common | Nov 8, 2024 | May 29, 2012 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub