CVE-2017-10689 Tarball permission preservation in puppet
MediumCVSS 5.5
EPSS 0.36%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | < 4.10.10 | 4.10.10 |
| rubygems puppet(RubyGems) | >= 5.0.0, < 5.3.4 | 5.3.4 |
| rubygems puppet(RubyGems) | = 0.13.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.13.1 | No fix listed |
| rubygems puppet(RubyGems) | = 0.13.2 | No fix listed |
| rubygems puppet(RubyGems) | = 0.13.6 | No fix listed |
| rubygems puppet(RubyGems) | = 0.16.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.18.4 | No fix listed |
| rubygems puppet(RubyGems) | = 0.22.4 | No fix listed |
| rubygems puppet(RubyGems) | = 0.23.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.23.1 | No fix listed |
| rubygems puppet(RubyGems) | = 0.23.2 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.1 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.2 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.3 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.4 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.5 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.6 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.7 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.8 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.9 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.1 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.2 | No fix listed |
Show 158 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | = 0.25.3 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.4 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.5 | No fix listed |
| rubygems puppet(RubyGems) | = 0.9.2 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.0 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.10 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.13 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.14 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.15 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.16 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.17 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.18 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.2 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.7 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.8 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.9 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.13 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.14 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.16 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.17 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.18 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.19 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.20 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.20.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.21 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.22 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.23 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.24 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.25 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.26 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.8 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.9 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.0 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.0.rc4 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.0.rc5 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.0.rc7 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.0.rc8 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.1.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.2.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.2.rc2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.0.2.rc3 | No fix listed |
| rubygems puppet(RubyGems) | = 3.1.0 | No fix listed |
| rubygems puppet(RubyGems) | = 3.1.0.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.1.0.rc2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.1.1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.2.0.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.2.0.rc2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.2.1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.2.1.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.2.2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.2.3 | No fix listed |
| rubygems puppet(RubyGems) | = 3.2.3.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.2.4 | No fix listed |
| rubygems puppet(RubyGems) | = 3.3.0 | No fix listed |
| rubygems puppet(RubyGems) | = 3.3.0.rc2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.3.0.rc3 | No fix listed |
| rubygems puppet(RubyGems) | = 3.3.1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.3.1.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.3.1.rc2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.3.1.rc3 | No fix listed |
| rubygems puppet(RubyGems) | = 3.3.2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.4.0 | No fix listed |
| rubygems puppet(RubyGems) | = 3.4.0.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.4.0.rc2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.4.1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.4.2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.4.3 | No fix listed |
| rubygems puppet(RubyGems) | = 3.5.0.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.5.0.rc2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.5.0.rc3 | No fix listed |
| rubygems puppet(RubyGems) | = 3.5.1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.5.1.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.6.0 | No fix listed |
| rubygems puppet(RubyGems) | = 3.6.0.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.6.1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.6.2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.7.0 | No fix listed |
| rubygems puppet(RubyGems) | = 3.7.1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.7.2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.7.3 | No fix listed |
| rubygems puppet(RubyGems) | = 3.7.4 | No fix listed |
| rubygems puppet(RubyGems) | = 3.7.5 | No fix listed |
| rubygems puppet(RubyGems) | = 3.8.1 | No fix listed |
| rubygems puppet(RubyGems) | = 3.8.2 | No fix listed |
| rubygems puppet(RubyGems) | = 3.8.3 | No fix listed |
| rubygems puppet(RubyGems) | = 3.8.4 | No fix listed |
| rubygems puppet(RubyGems) | = 3.8.5 | No fix listed |
| rubygems puppet(RubyGems) | = 3.8.6 | No fix listed |
| rubygems puppet(RubyGems) | = 3.8.7 | No fix listed |
| rubygems puppet(RubyGems) | = 4.0.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.0.0.rc1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.1.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.10.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.10.1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.10.4 | No fix listed |
| rubygems puppet(RubyGems) | = 4.10.5 | No fix listed |
| rubygems puppet(RubyGems) | = 4.10.6 | No fix listed |
| rubygems puppet(RubyGems) | = 4.10.7 | No fix listed |
| rubygems puppet(RubyGems) | = 4.10.8 | No fix listed |
| rubygems puppet(RubyGems) | = 4.10.9 | No fix listed |
| rubygems puppet(RubyGems) | = 4.2.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.2.1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.2.2 | No fix listed |
| rubygems puppet(RubyGems) | = 4.2.3 | No fix listed |
| rubygems puppet(RubyGems) | = 4.3.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.3.1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.3.2 | No fix listed |
| rubygems puppet(RubyGems) | = 4.4.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.4.1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.4.2 | No fix listed |
| rubygems puppet(RubyGems) | = 4.5.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.5.1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.5.2 | No fix listed |
| rubygems puppet(RubyGems) | = 4.5.3 | No fix listed |
| rubygems puppet(RubyGems) | = 4.6.1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.6.2 | No fix listed |
| rubygems puppet(RubyGems) | = 4.7.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.7.1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.8.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.8.1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.8.2 | No fix listed |
| rubygems puppet(RubyGems) | = 4.9.0 | No fix listed |
| rubygems puppet(RubyGems) | = 4.9.1 | No fix listed |
| rubygems puppet(RubyGems) | = 4.9.2 | No fix listed |
| rubygems puppet(RubyGems) | = 4.9.3 | No fix listed |
| rubygems puppet(RubyGems) | = 4.9.4 | No fix listed |
| rubygems puppet(RubyGems) | = 5.0.0 | No fix listed |
| rubygems puppet(RubyGems) | = 5.0.1 | No fix listed |
| rubygems puppet(RubyGems) | = 5.1.0 | No fix listed |
| rubygems puppet(RubyGems) | = 5.2.0 | No fix listed |
| rubygems puppet(RubyGems) | = 5.3.1 | No fix listed |
| rubygems puppet(RubyGems) | = 5.3.2 | No fix listed |
| rubygems puppet(RubyGems) | = 5.3.3 | No fix listed |
| debian/puppet(Debian:11) | < 5.4.0-1 | 5.4.0-1 |
| puppet | < 5.3.4 | 5.3.4 |
| puppet | >= 1.10.0, < 1.10.10 | 1.10.10 |
| puppet enterprise | < 2016.4.10 | 2016.4.10 |
| puppet enterprise | >= 2017.1.0, < 2017.3.4 | 2017.3.4 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| redhat satellite | = 6.4 | No fix listed |
| puppet enterprise | = prior to 2016.4.10 or 2017.3.4 | No fix listed |
| puppet agent | = prior to 5.3.4 or 1.10.10 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2018:2927 third-party-advisory vendor-advisory
- puppet.com vendor-advisory
- USN-3567-1 third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- tickets.puppetlabs.com
- github.com exploit
- github.com
- github.com product
- security-tracker.debian.org vendor-advisory