CVE-2014-3248Inclusion of Functionality from Untrusted Control Sphere in Hiera

Severity
6.2MEDIUMNVD
EPSS
0.1%
top 77.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 16
Latest updateOct 24

Description

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/dee

CVSS vector

AV:L/AC:H/C:C/I:C/A:CExploitability: 1.9 | Impact: 10.0

Affected Packages10 packages

NVDpuppet/hiera< 1.3.4
NVDpuppet/puppet_enterprise2.8.02.8.7
Debianpuppet/mcollective< 2.5.2+dfsg-1+1
NVDpuppetlabs/facter1.6.01.6.18
NVDpuppet/facter2.0.0, 2.0.1+1

🔴Vulnerability Details

5
GHSA
facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability2017-10-24
OSV
facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability2017-10-24
OSV
puppet vulnerabilities2017-06-05
OSV
CVE-2014-3248: Untrusted search path vulnerability in Puppet Enterprise 22014-11-16
CVEList
CVE-2014-3248: Untrusted search path vulnerability in Puppet Enterprise 22014-11-16

📋Vendor Advisories

3
Ubuntu
Puppet vulnerabilities2017-06-05
Red Hat
puppet: Ruby modules could be loaded from the current working directory2014-06-10
Debian
CVE-2014-3248: facter - Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppe...2014

💬Community

7
Bugzilla
CVE-2014-3248 facter: puppet: Ruby modules could be loaded from the current working directory [fedora-20]2014-07-01
Bugzilla
CVE-2014-3248 mcollective: puppet: Ruby modules could be loaded from the current working directory [epel-all]2014-06-11
Bugzilla
CVE-2014-3248 hiera: puppet: Ruby modules could be loaded from the current working directory [epel-6]2014-06-11
Bugzilla
CVE-2014-3248 facter: puppet: Ruby modules could be loaded from the current working directory [fedora-19]2014-06-11
Bugzilla
CVE-2014-3248 facter: puppet: Ruby modules could be loaded from the current working directory [epel-all]2014-06-11
CVE-2014-3248 — Puppet Hiera vulnerability | cvebase