CVE-2011-3871

CVE-2011-3871 is described in the connected advisory as a vulnerability in Puppet where, in --edit mode, certain Puppet versions (2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x) use a predictable file name. This allows local users to run arbitrary Puppet code or trick a user into editing arb...

CVE-2011-3848

Removed by vendor...

CVE-2011-3872

CVE-2011-3872 affects Puppet 2.6.x <2.6.12, 2.7.x <2.7.6, and Puppet Enterprise 1.0–1.2

CVE-2011-3848

Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request CSR to arbitrary locations via 1 a double-encoded key parameter in the URI in 2.7.x, 2 the CN in the Subject of a CSR in 2.6 and 0.25...

CVE-2011-3869

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file...

CVE-2011-3871

Removed by vendor...

CVE-2011-3870

Removed by vendor...

CVE-2011-3871

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...

CVE-2011-3870

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorizedkeys file...

CVE-2011-3848

CVE-2011-3848: A directory traversal in Puppet allows writing X.509 certificate signing requests to arbitrary locations. Affected: Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4. Exploitation methods in the connected docs include (1) a double-encoded key parameter in the URI (2.7.x) and (2) th...

CVE-2011-3869

Removed by vendor...

CVE-2011-3872

Removed by vendor...

CVE-2011-3869: Improper Link Resolution Before File Access

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file...

Puppet uses predictable filenames, allowing arbitrary file overwrite

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...

CVE-2011-3848: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request CSR to arbitrary locations via 1 a double-encoded key parameter in the URI in 2.7.x, 2 the CN in the Subject of a CSR in 2.6 and 0.25...

CVE-2011-3872: Improper Input Validation

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise PE Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof ...

CVE-2011-3870: Improper Link Resolution Before File Access

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorizedkeys file...

Puppet allows local users to modify the permissions of arbitrary files

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorizedkeys file...

CVE-2011-3871: Undefined Security Weakness

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...

Ubuntu 11.04 : puppet regression (USN-1238-2)

USN-1238-1 fixed vulnerabilities in Puppet. The upstream patch introduced a regression in Ubuntu 11.04 when executing certain commands. This update fixes the problem. We apologize for the inconvenience. It was discovered that Puppet incorrectly handled the non-default 'certdnsnames' option when...