puppet (RubyGems)
Advisories
41
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.12.1 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update puppet # Gemfile: gem "puppet", ">= 7.12.1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mpmx-gm5v-q789 Puppet uses predictable filenames, allowing arbitrary file overwrite |
Medium EPSS 0.34% |
< 2.6.11 | 2.6.11 |
| GHSA-9pvx-fwwh-w289 Puppet does not properly restrict access to node resources |
Medium EPSS 1.65% |
>= 2.6.0, < 2.6.4 | 2.6.4 |
| GHSA-mpmx-gm5v-q789 Puppet uses predictable filenames, allowing arbitrary file overwrite |
Medium EPSS 0.34% |
>= 2.7.0, < 2.7.5 | 2.7.5 |
| GHSA-8c56-v25w-f89c Puppet arbitrary file overwrite |
Medium EPSS 0.34% |
>= 2.7.0, < 2.7.5 | 2.7.5 |
| GHSA-qh3g-27jf-3j54 Puppet allows local users to modify the permissions of arbitrary files |
Medium EPSS 0.35% |
>= 2.7.0, < 2.7.5 | 2.7.5 |
| GHSA-qh3g-27jf-3j54 Puppet allows local users to modify the permissions of arbitrary files |
Medium EPSS 0.35% |
< 2.6.11 | 2.6.11 |
| GHSA-8c56-v25w-f89c Puppet arbitrary file overwrite |
Medium EPSS 0.34% |
< 2.6.11 | 2.6.11 |
| GHSA-c4mc-49hq-q275 Puppet uses predictable filenames, allowing arbitrary file overwrite |
Medium EPSS 0.35% |
>= 2.7, < 2.7.13 | 2.7.13 |
| GHSA-6xxq-j39w-g3f6 Puppet Arbitrary Command Execution |
Medium EPSS 2.60% |
>= 2.6.0, < 2.6.15 | 2.6.15 |
| GHSA-c4mc-49hq-q275 Puppet uses predictable filenames, allowing arbitrary file overwrite |
Medium EPSS 0.35% |
>= 2.6, < 2.6.15 | 2.6.15 |
| GHSA-v58w-6xc2-w799 Puppet Denial of Service and Arbitrary File Write |
Low EPSS 2.52% |
>= 2.6.0, < 2.6.15 | 2.6.15 |
| GHSA-v58w-6xc2-w799 Puppet Denial of Service and Arbitrary File Write |
Low EPSS 2.52% |
>= 2.7.0, < 2.7.13 | 2.7.13 |
| GHSA-6xxq-j39w-g3f6 Puppet Arbitrary Command Execution |
Medium EPSS 2.60% |
>= 2.7.0, < 2.7.13 | 2.7.13 |
| GHSA-77hg-g8cc-5r37 Puppet Privilege Escallation |
Medium EPSS 0.38% |
>= 2.6, < 2.6.14 | 2.6.14 |
| GHSA-77hg-g8cc-5r37 Puppet Privilege Escallation |
Medium EPSS 0.38% |
>= 2.7, < 2.7.11 | 2.7.11 |
| GHSA-vw22-465p-8j5w Tarball permission preservation in puppet |
Medium EPSS 0.36% |
>= 5.0.0, < 5.3.4 | 5.3.4 |
| GHSA-vw22-465p-8j5w Tarball permission preservation in puppet |
Medium EPSS 0.36% |
< 4.10.10 | 4.10.10 |
| GHSA-pqj5-7r86-64fv Puppet Improper Access Control |
Critical EPSS 2.89% |
>= 4.0.0, < 4.4.2 | 4.4.2 |
| GHSA-vrh7-99jh-3fmm Puppet arbitrary files overwrite via a symlink attack |
Low EPSS 0.33% |
>= 0.24.0, < 0.24.9 | 0.24.9 |
| GHSA-vrh7-99jh-3fmm Puppet arbitrary files overwrite via a symlink attack |
Low EPSS 0.33% |
>= 0.25.0, < 0.25.2 | 0.25.2 |
| GHSA-q4g7-jrxv-67r9 Silent Configuration Failure in Puppet Agent |
Medium EPSS 1.11% |
< 6.25.1 | 6.25.1 |
| GHSA-q4g7-jrxv-67r9 Silent Configuration Failure in Puppet Agent |
Medium EPSS 1.11% |
>= 7.0.0, < 7.12.1 | 7.12.1 |
| GHSA-93j5-g845-9wqp Unsafe HTTP Redirect in Puppet Agent and Puppet Server |
Medium EPSS 1.37% |
< 6.25.1 | 6.25.1 |
| GHSA-93j5-g845-9wqp Unsafe HTTP Redirect in Puppet Agent and Puppet Server |
Medium EPSS 1.37% |
>= 7.0.0, < 7.12.1 | 7.12.1 |
| GHSA-gqvf-892r-vjm5 Improper Certificate Validation in Puppet |
Medium EPSS 0.80% |
< 5.5.19 | 5.5.19 |
| GHSA-gqvf-892r-vjm5 Improper Certificate Validation in Puppet |
Medium EPSS 0.80% |
>= 6.0.0, < 6.13.0 | 6.13.0 |
| GHSA-vxf6-w9mp-95hm Puppet supports use of IP addresses in certnames without warning of potential risks |
Low EPSS 1.64% |
< 2.7.18 | 2.7.18 |
| GHSA-c5qq-g673-5p49 Puppet allows local users to overwrite arbitrary files via a symlink attack |
Low EPSS 0.40% |
>= 2.7.1, < 2.7.13 | 2.7.13 |
| GHSA-cj43-9h3w-v976 Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service |
Medium EPSS 1.64% |
>= 3.2.0, < 3.2.4 | 3.2.4 |
| GHSA-574q-fxfj-wv6h Puppet Improper Input Validation vulnerability |
High EPSS 4.56% |
>= 3.1.0, < 3.1.1 | 3.1.1 |
| GHSA-8jxj-9r5f-w3m2 Puppet allows local users to obtain sensitive configuration information |
Low EPSS 0.48% |
>= 2.7.0, < 2.7.18 | 2.7.18 |
| GHSA-f7p5-w2cr-7cp7 Puppet Improper Input Validation vulnerability |
High EPSS 3.41% |
>= 2.7.0, < 2.7.22 | 2.7.22 |
| GHSA-f7p5-w2cr-7cp7 Puppet Improper Input Validation vulnerability |
High EPSS 3.41% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-cj43-9h3w-v976 Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service |
Medium EPSS 1.64% |
>= 2.7.0, < 2.7.23 | 2.7.23 |
| GHSA-574q-fxfj-wv6h Puppet Improper Input Validation vulnerability |
High EPSS 4.56% |
>= 2.7.0, < 2.7.21 | 2.7.21 |
| GHSA-g89m-3wjw-h857 Puppet vulnerable to Path Traversal |
Low EPSS 1.88% |
< 2.6.17 | 2.6.17 |
| GHSA-g89m-3wjw-h857 Puppet vulnerable to Path Traversal |
Low EPSS 1.88% |
>= 2.7.0, < 2.7.18 | 2.7.18 |
| GHSA-q44r-f2hm-v76v Pupper does not properly restrict characters in Common Name field of Certificate Signing Request |
Medium EPSS 2.45% |
< 2.6.17 | 2.6.17 |
| GHSA-q44r-f2hm-v76v Pupper does not properly restrict characters in Common Name field of Certificate Signing Request |
Medium EPSS 2.45% |
>= 2.7.0, < 2.7.18 | 2.7.18 |
| GHSA-92v7-pq4h-58j5 facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability |
Medium EPSS 0.54% |
>= 3.0.0, < 3.6.2 | 3.6.2 |
| GHSA-92v7-pq4h-58j5 facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability |
Medium EPSS 0.54% |
< 2.7.26 | 2.7.26 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor