Issue #13260 has been updated by Matthaus Litteken. Private changed from Yes to No Affected Puppet version changed from 2.7.12 to 2.6.0
---------------------------------------- Bug #13260: appdmg and pkgdmg providers write packages to insecure location https://projects.puppetlabs.com/issues/13260#change-60334 Author: Patrick Carlisle Status: Closed Priority: Normal Assignee: Patrick Carlisle Category: security Target version: 2.7.13 Affected Puppet version: 2.6.0 Keywords: Branch: https://github.com/pcarlisle/puppet-cve-test/tree/ticket/2.7.x/13260-dmg-providers These providers are only used on darwin. If a remote source is given for a package, the package is downloaded to a predictable filename in /tmp. It is possible to create a symlink at this name and use it to clobber any file on the system, or by switching the symlink install arbitrary packages (and package installers can execute arbitrary code). -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: http://projects.puppetlabs.com/my/account -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/puppet-bugs?hl=en.
