Arbitrary File Access Affecting puppet package, versions <0.24.8 >=0.25.0, <0.25.2
Threat Intelligence
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PUPPET-20300
- published 28 Feb 2017
- disclosed 27 May 2009
- credit Till Maas
Introduced: 27 May 2009
CVE-2010-0156 Open this link in a new tabHow to fix?
Upgrade puppet to version 2.6.4 or higher.
Overview
puppet is an automated configuration management tool.
Affected versions of the package are vulnerable to Arbitrary File Access via Symlink Attack. Puppet creates temporary files in /tmp with predictable names. These could be used by an attacker to cause a Denial of Service (DoS) attack by setting a symlink to some other file and waiting for puppet to overwrite it.
References
CVSS Scores
version 3.1