CVE-2012-1906

Published: 11 April 2012

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Priority

Negligible

Status

Package Release Status
puppet
Launchpad, Ubuntu, Debian
Upstream Needs triage

Notes

AuthorNote
tyhicks
Yama mitigates this
Despite these being OS X package providers, we do ship them so they
will get patched

References

Bugs