Security Information / 2013 / Security Information -- DSA-2831-1 puppet

Debian Security Advisory

DSA-2831-1 puppet -- insecure temporary files

Date Reported:

31 Dec 2013

Affected Packages:

puppet

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2013-4969.

More information:

An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system.

For the oldstable distribution (squeeze), this problem has been fixed in version 2.6.2-5+squeeze9.

For the stable distribution (wheezy), this problem has been fixed in version 2.7.23-1~deb7u2.

For the testing distribution (jessie), this problem has been fixed in version 3.4.1-1.

For the unstable distribution (sid), this problem has been fixed in version 3.4.1-1.

We recommend that you upgrade your puppet packages.