Security update for rubygem-puppet SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:0471-1 Final 1 1 2018-02-19T09:08:46Z current 2018-02-19T09:08:46Z 2018-02-19T09:08:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-puppet This update for rubygem-puppet fixes the following issues: - CVE-2017-10689: Reset permissions when unpacking tar in PMT. When using minitar, files are unpacked with whatever permissions are in the tarball. This is potentially unsafe, as tarballs can be easily created with weird permissions (boo#1080288) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2018-02/msg00058.html E-Mail link for openSUSE-SU-2018:0471-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 ruby2.1-rubygem-puppet-3.8.7-23.1 ruby2.1-rubygem-puppet-doc-3.8.7-23.1 ruby2.1-rubygem-puppet-testsuite-3.8.7-23.1 ruby2.2-rubygem-puppet-3.8.7-23.1 ruby2.2-rubygem-puppet-doc-3.8.7-23.1 ruby2.2-rubygem-puppet-testsuite-3.8.7-23.1 ruby2.3-rubygem-puppet-3.8.7-23.1 ruby2.3-rubygem-puppet-doc-3.8.7-23.1 ruby2.3-rubygem-puppet-testsuite-3.8.7-23.1 ruby2.4-rubygem-puppet-3.8.7-23.1 ruby2.4-rubygem-puppet-doc-3.8.7-23.1 ruby2.4-rubygem-puppet-testsuite-3.8.7-23.1 rubygem-puppet-3.8.7-23.1 rubygem-puppet-emacs-3.8.7-23.1 rubygem-puppet-master-3.8.7-23.1 rubygem-puppet-master-unicorn-3.8.7-23.1 rubygem-puppet-vim-3.8.7-23.1 ruby2.1-rubygem-puppet-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.1-rubygem-puppet-doc-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.1-rubygem-puppet-testsuite-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.2-rubygem-puppet-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.2-rubygem-puppet-doc-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.2-rubygem-puppet-testsuite-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.3-rubygem-puppet-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.3-rubygem-puppet-doc-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.3-rubygem-puppet-testsuite-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.4-rubygem-puppet-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.4-rubygem-puppet-doc-3.8.7-23.1 as a component of openSUSE Leap 42.3 ruby2.4-rubygem-puppet-testsuite-3.8.7-23.1 as a component of openSUSE Leap 42.3 rubygem-puppet-3.8.7-23.1 as a component of openSUSE Leap 42.3 rubygem-puppet-emacs-3.8.7-23.1 as a component of openSUSE Leap 42.3 rubygem-puppet-master-3.8.7-23.1 as a component of openSUSE Leap 42.3 rubygem-puppet-master-unicorn-3.8.7-23.1 as a component of openSUSE Leap 42.3 rubygem-puppet-vim-3.8.7-23.1 as a component of openSUSE Leap 42.3 In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability. CVE-2017-10689 openSUSE Leap 42.3:ruby2.1-rubygem-puppet-3.8.7-23.1 openSUSE Leap 42.3:ruby2.1-rubygem-puppet-doc-3.8.7-23.1 openSUSE Leap 42.3:ruby2.1-rubygem-puppet-testsuite-3.8.7-23.1 openSUSE Leap 42.3:ruby2.2-rubygem-puppet-3.8.7-23.1 openSUSE Leap 42.3:ruby2.2-rubygem-puppet-doc-3.8.7-23.1 openSUSE Leap 42.3:ruby2.2-rubygem-puppet-testsuite-3.8.7-23.1 openSUSE Leap 42.3:ruby2.3-rubygem-puppet-3.8.7-23.1 openSUSE Leap 42.3:ruby2.3-rubygem-puppet-doc-3.8.7-23.1 openSUSE Leap 42.3:ruby2.3-rubygem-puppet-testsuite-3.8.7-23.1 openSUSE Leap 42.3:ruby2.4-rubygem-puppet-3.8.7-23.1 openSUSE Leap 42.3:ruby2.4-rubygem-puppet-doc-3.8.7-23.1 openSUSE Leap 42.3:ruby2.4-rubygem-puppet-testsuite-3.8.7-23.1 openSUSE Leap 42.3:rubygem-puppet-3.8.7-23.1 openSUSE Leap 42.3:rubygem-puppet-emacs-3.8.7-23.1 openSUSE Leap 42.3:rubygem-puppet-master-3.8.7-23.1 openSUSE Leap 42.3:rubygem-puppet-master-unicorn-3.8.7-23.1 openSUSE Leap 42.3:rubygem-puppet-vim-3.8.7-23.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-02/msg00058.html https://www.suse.com/security/cve/CVE-2017-10689.html CVE-2017-10689 https://bugzilla.suse.com/1080288 SUSE Bug 1080288