CVE-2014-3248: Moderate severity vulnerability that affects facter, hiera, mcollective-client, and puppet

October 24, 2017 (updated September 7, 2021)

Untrusted search path vulnerability in Puppet Enterprise, Puppet, Facter, Hiera, and Mcollective, when running with Ruby or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

References

puppetlabs.com/security/cve/cve-2014-3248
rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/
secunia.com/advisories/59197
secunia.com/advisories/59200
www.securityfocus.com/bid/68035
github.com/advisories/GHSA-92v7-pq4h-58j5
nvd.nist.gov/vuln/detail/CVE-2014-3248

Detect and mitigate CVE-2014-3248 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →