Total vulnerabilities in the database
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
| Software | From | Fixed in |
|---|---|---|
| puppetlabs / puppet | 2.7.0 | 2.7.0.x |
| puppetlabs / puppet | 2.7.1 | 2.7.1.x |
| puppet / puppet | 2.6.0 | 2.6.0.x |
| puppet / puppet | 2.6.1 | 2.6.1.x |
| puppet / puppet | 2.6.2 | 2.6.2.x |
| puppet / puppet | 2.6.3 | 2.6.3.x |
| puppet / puppet | 2.6.4 | 2.6.4.x |
| puppet / puppet | 2.6.5 | 2.6.5.x |
| puppet / puppet | 2.6.6 | 2.6.6.x |
| puppet / puppet | 2.6.7 | 2.6.7.x |
| puppet / puppet | 2.6.8 | 2.6.8.x |
| puppet / puppet | 2.6.9 | 2.6.9.x |
| puppet / puppet | 2.6.10 | 2.6.10.x |
| puppet / puppet | 2.7.2 | 2.7.2.x |
| puppet / puppet | 2.7.3 | 2.7.3.x |
| puppet / puppet | 2.7.4 | 2.7.4.x |
| puppet / puppet | 0.25.1 | 0.25.1.x |
| puppet / puppet | 0.25.0 | 0.25.0.x |
| puppet / puppet | 0.25.2 | 0.25.2.x |
| puppet / puppet | 0.25.3 | 0.25.3.x |
| puppet / puppet | 0.25.4 | 0.25.4.x |
| puppet / puppet | 0.25.5 | 0.25.5.x |
| puppet / puppet | 0.25.6 | 0.25.6.x |