netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-92v7-pq4h-58j5

Browse Source
This commit is contained in:
advisory-database[bot]
2023-05-16 16:00:05 +00:00
parent 13adf9b80f
commit 64cab719f0
1 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2017/10/GHSA-92v7-pq4h-58j5/GHSA-92v7-pq4h-58j5.json
+11 -11
View File
@@ -1,12 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-92v7-pq4h-58j5",
"modified": "2023-04-14T20:27:54Z",
"modified": "2023-05-16T15:58:52Z",
"published": "2017-10-24T18:33:36Z",
"aliases": [
"CVE-2014-3248"
],
"summary": "Moderate severity vulnerability that affects facter, hiera, mcollective-client, and puppet",
"summary": "facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability",
"details": "Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.",
"severity": [
@@ -132,33 +132,33 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3248"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-92v7-pq4h-58j5"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/facter/CVE-2014-3248.yml"
},
{
"type": "WEB",
"url": "http://puppetlabs.com/security/cve/cve-2014-3248"
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/hiera/CVE-2014-3248.yml"
},
{
"type": "WEB",
"url": "http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/"
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mcollective-client/CVE-2014-3248.yml"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59197"
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2014-3248.yml"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59200"
"url": "https://web.archive.org/web/20141129061319/http://www.securityfocus.com/bid/68035"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/68035"
"url": "https://web.archive.org/web/20150204183209/http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20150907182402/http://puppetlabs.com/security/cve/cve-2014-3248"
}
],
"database_specific": {