Moderate severityNVD Advisory· Published Oct 27, 2011· Updated Apr 29, 2026
CVE-2011-3869
CVE-2011-3869
Description
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
puppetRubyGems | >= 2.7.0, < 2.7.5 | 2.7.5 |
puppetRubyGems | < 2.6.11 | 2.6.11 |
Affected products
23cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:puppet:puppet:0.25.0:*:*:*:*:*:*:*+ 20 more
- cpe:2.3:a:puppet:puppet:0.25.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.4:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.5:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.6:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*
Patches
27d4c169df84f(#9794) k5login can overwrite arbitrary files as root
1 file changed · +3 −1
lib/puppet/type/k5login.rb+3 −1 modified@@ -79,7 +79,9 @@ def mode=(value) private def write(value) - File.open(@resource[:name], "w") { |f| f.puts value.join("\n") } + Puppet::Util.secure_open(@resource[:name], "w") do |f| + f.puts value.join("\n") + end end end end
2775c21ae48e(#9794) k5login can overwrite arbitrary files as root
1 file changed · +3 −1
lib/puppet/type/k5login.rb+3 −1 modified@@ -79,7 +79,9 @@ def mode=(value) private def write(value) - File.open(@resource[:name], "w") { |f| f.puts value.join("\n") } + Puppet::Util.secure_open(@resource[:name], "w") do |f| + f.puts value.join("\n") + end end end end
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
14- groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cbnvdPatchWEB
- lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.htmlnvdPatchWEB
- lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.htmlnvdPatchWEB
- secunia.com/advisories/46458nvdVendor Advisory
- github.com/advisories/GHSA-8c56-v25w-f89cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2011-3869ghsaADVISORY
- lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.htmlnvdWEB
- www.debian.org/security/2011/dsa-2314nvdWEB
- www.ubuntu.com/usn/USN-1223-1nvdWEB
- www.ubuntu.com/usn/USN-1223-2nvdWEB
- github.com/puppetlabs/puppet/commit/2775c21ae48e189950dbea5e7b4d1d9fa2aca41cghsaWEB
- github.com/puppetlabs/puppet/commit/7d4c169df84fc7bbeb2941bf995a63470f71bdbdghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2011-3869.ymlghsaWEB
- puppet.com/security/cve/cve-2011-3869nvdWEB
News mentions
0No linked articles in our index yet.