danielparks puppet-golang up to 1.2.6 on macOS dp-golang permission assignment

Summaryinfo

A vulnerability has been found in danielparks puppet-golang up to 1.2.6 on macOS and classified as problematic. This impacts an unknown function of the component dp-golang. Performing a manipulation results in permission assignment. This vulnerability was named CVE-2024-27294. The attack needs to be approached locally. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in danielparks puppet-golang up to 1.2.6 on macOS (Service Management Software). It has been classified as problematic. This affects an unknown part of the component dp-golang. The manipulation with an unknown input leads to a permission assignment vulnerability. CWE is classifying the issue as CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group

The weakness was presented 03/01/2024 as GHSA-8h8m-h98f-vv84. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-27294 since 02/22/2024. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.2.7 eliminates this vulnerability. Applying the patch 1d0865b24071cb1c00d2fd8cb755d444e6e8f888 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Service Management Software

Vendor

• danielparks

Name

• puppet-golang

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6

License

• open-source

Website

• Product: https://github.com/danielparks/puppet-golang/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion