GHSA-c5qq-g673-5p49

Suggest an improvement
Source
https://github.com/advisories/GHSA-c5qq-g673-5p49
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-c5qq-g673-5p49/GHSA-c5qq-g673-5p49.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c5qq-g673-5p49
Aliases
Published
2017-10-24T18:33:38Z
Modified
2024-11-29T05:42:00Z
Summary
Puppet allows local users to overwrite arbitrary files via a symlink attack
Details

telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).

Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:30:16Z",
    "nvd_published_at":  "2012-06-27T18:55:01Z",
    "severity":  "LOW"
}
References

Affected packages

RubyGems / puppet

Package

Name
puppet
Purl
pkg:gem/puppet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.7.1
Fixed
2.7.13

Affected versions

2.*
2.7.1
2.7.3
2.7.4
2.7.5
2.7.6
2.7.8
2.7.9
2.7.11
2.7.12

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-c5qq-g673-5p49/GHSA-c5qq-g673-5p49.json"