Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
CVSS Details
- CVSS 3.1 Base Score: 7.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mcollectiveUpgrade hieraUpgrade facterUpgrade puppet | Jul 30, 2024 | Nov 16, 2014 |
| Gentoo Linux | — | Upgrade dev-ruby/facter.Upgrade app-admin/mcollective. | Oct 30, 2017 | Nov 16, 2014 |
| Oracle Solaris | — | Upgrade system/management/facter to version 2.1.0-0.175.2.4.0.4.0 on Solaris 11.2Upgrade system/management/puppet-19 to version 3.6.2-0.175.2.5.0.2.0 on Solaris 11.2Upgrade system/management/facter-19 to version 2.1.0-0.175.2.4.0.4.0 on Solaris 11.2Upgrade system/management/puppet to version 3.6.2-0.175.2.5.0.2.0 on Solaris 11.2 | May 29, 2017 | Nov 16, 2014 |
| Suse | — | Upgrade facterUpgrade puppet-serverUpgrade puppet | Dec 18, 2015 | Jul 8, 2014 |
| Ubuntu | — | Upgrade puppet-common | Jun 5, 2017 | Nov 16, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub