CVE-2011-3870
No CVSS score yet. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in puppet 2.6.11, 2.7.5.
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
- CWE
- CWE-59
- Published
- Modified
- Record from
- the NVD, synced
Affected
- puppet:puppet
- puppetlabs:puppet
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qh3g-27jf-3j54 | RubyGems | puppet | >=2.7.0 <2.7.5 | 2.7.5 |
| GHSA-qh3g-27jf-3j54 | RubyGems | puppet | <2.6.11 | 2.6.11 |
References
- http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb
- http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html
- http://secunia.com/advisories/46458