PT-2018-17602
CVE-2018-6513
·
تاريخ النشر
2018-06-11
·
تاريخ التحديث
2022-01-24
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Puppet Enterprise versions 2016.4.x through 2016.4.11
Puppet Enterprise versions 2017.3.x through 2017.3.6
Puppet Enterprise versions 2018.1.x through 2018.1.0
Puppet Agent versions 1.10.x through 1.10.12
Puppet Agent versions 5.3.x through 5.3.6
Puppet Agent versions 5.5.x through 5.5.1
Description
The issue allows an unprivileged user on Windows agents to write custom facts that can escalate privileges on the next puppet run. This is possible through the loading of shared libraries from untrusted paths.
Recommendations
For Puppet Enterprise versions 2016.4.x through 2016.4.11, update to version 2016.4.12 or later.
For Puppet Enterprise versions 2017.3.x through 2017.3.6, update to version 2017.3.7 or later.
For Puppet Enterprise versions 2018.1.x through 2018.1.0, update to version 2018.1.1 or later.
For Puppet Agent versions 1.10.x through 1.10.12, update to version 1.10.13 or later.
For Puppet Agent versions 5.3.x through 5.3.6, update to version 5.3.7 or later.
For Puppet Agent versions 5.5.x through 5.5.1, update to version 5.5.2 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾