File injection Affecting puppet package, versions <2.6.11 >=2.7.0, <2.7.5
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PUPPET-20306
- published 28 Feb 2017
- disclosed 29 Sep 2011
- credit Puppet Labs
How to fix?
Upgrade puppet to version 2.6.11, 2.7.5 or higher.
Overview
puppet is an automated configuration management tool.
Affected versions of the package are vulnerable to File injection. The indirector/file.rb file base class in the indirector trusted the request key directly and used it as part of the pathname. This made it vulnerable to the same potential for injection attacks as other terminus base classes.
Note: The only consumer of the code was in the tests
CVSS Scores
version 3.1