CVE-2009-3564

puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.

Score

CVSS 2.0 4.7 Medium

Status

Modified - cve@mitre.org

Published

2009-10-06

Last modified

2024-08-07

Weaknesses

CWE-264

Affected products

• Puppet (Reductivelabs)

References

• http://projects.reductivelabs.com/issues/1806
• https://bugzilla.redhat.com/show_bug.cgi?id=475201
• https://puppet.com/security/cve/cve-2009-3564