GHSA-vw22-465p-8j5w
Tarball permission preservation in puppet
At a glance
- Published
- Updated
- CVE
- CVE-2017-10689
- CVSS_V3
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Description
When installing a module using the system tar, the PMT will filter filesystem permissions to a sane value. This may just be based on the user's umask. When using minitar, files are unpacked with whatever permissions are in the tarball. This is potentially unsafe, as tarballs can be easily created with weird permissions.
Affected packages
| Package | Versions |
|---|---|
| RubyGems · puppet | introduced 0, fixed 4.10.10 |
| RubyGems · puppet | introduced 5.0.0, fixed 5.3.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-10689 ADVISORY
- https://github.com/puppetlabs/puppet/commit/17d9e02da3882e44c1876e2805cf9708481715ee WEB
- https://github.com/puppetlabs/puppet/commit/2f1047f85e22cde139a421bc25d371f2ffc92cb1 WEB
- https://access.redhat.com/errata/RHSA-2018:2927 WEB
- https://github.com/puppetlabs/puppet PACKAGE
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2017-10689.yml WEB
- https://puppet.com/security/cve/CVE-2017-10689 WEB
- https://tickets.puppetlabs.com/browse/PUP-7866 WEB
- https://usn.ubuntu.com/3567-1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |