CVE-2017-10689

puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions

Published Feb 9, 2018 CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-5438 In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.
Github GHSA Github GHSA GHSA-vw22-465p-8j5w Tarball permission preservation in puppet
Ubuntu USN Ubuntu USN USN-3567-1 Puppet vulnerability
Ubuntu USN Ubuntu USN USN-4804-1 Puppet vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
puppet
Published
Updated
Sep 17, 2024, 12:20 AM
Reserved
Jun 29, 2017, 12:00 AM
Status
Modified
Published
Feb 9, 2018, 8:29 PM
Modified
Jun 17, 2026, 1:00 AM
Severity
Low
Public date
Aug 28, 2017, 12:00 AM