GHSA-vrh7-99jh-3fmm

Source

https://github.com/advisories/GHSA-vrh7-99jh-3fmm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vrh7-99jh-3fmm/GHSA-vrh7-99jh-3fmm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vrh7-99jh-3fmm

Aliases

CVE-2010-0156

Published

2022-05-02T06:10:33Z

Modified

2024-12-03T06:08:48Z

Summary

Puppet arbitrary files overwrite via a symlink attack

Details

Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.

Database specific

{
    "cwe_ids": [
        "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-06T22:38:26Z",
    "nvd_published_at": "2010-03-03T19:30:00Z",
    "severity": "LOW"
}

References

Affected packages

RubyGems / puppet

Package

Name: puppet
Purl: pkg:gem/puppet

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.24.0

Fixed

0.24.9

Affected versions

0.*

0.24.0

0.24.1

0.24.2

0.24.3

0.24.4

0.24.5

0.24.6

0.24.7

0.24.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vrh7-99jh-3fmm/GHSA-vrh7-99jh-3fmm.json"