Arbitrary Code Execution Affecting puppet package, versions <2.6.15 >=2.7.0, <2.7.13
Snyk CVSS
Attack Complexity
Low
User Interaction
Required
Threat Intelligence
EPSS
0.47% (76th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PUPPET-20313
- published 28 Feb 2017
- disclosed 2 Apr 2011
- credit Puppet Labs
How to fix?
Upgrade puppet to version 2.6.15, 2.7.13 or higher.
Overview
puppet is an automated configuration management tool.
Affected versions of the package are vulnerable to Arbitrary Code Execution attacks. A malicious user who has access to agent SSL keys and file-creation permission may be able to create a file whose full pathname contains executable commands, then craft a file bucket request to execute these commands on the puppet master.