Moderate severityNVD Advisory· Published Oct 27, 2011· Updated Jun 16, 2026
CVE-2011-3870
CVE-2011-3870
Description
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
puppetRubyGems | >= 2.7.0, < 2.7.5 | 2.7.5 |
puppetRubyGems | < 2.6.11 | 2.6.11 |
Affected products
24cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*+ 22 more
- cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.4:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.5:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.6:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
14- groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cbnvdPatchWEB
- lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.htmlnvdPatchWEB
- lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.htmlnvdPatchWEB
- lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.htmlnvdPatchWEB
- secunia.com/advisories/46458nvdVendor Advisory
- github.com/advisories/GHSA-qh3g-27jf-3j54ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2011-3870ghsaADVISORY
- www.debian.org/security/2011/dsa-2314nvdWEB
- www.ubuntu.com/usn/USN-1223-1nvdWEB
- www.ubuntu.com/usn/USN-1223-2nvdWEB
- github.com/puppetlabs/puppet/commit/88512e880bd2a03694b5fef42540dc7b3da05d30ghsaWEB
- github.com/puppetlabs/puppet/commit/b29b1785d543a3cea961fffa9b3c15f14ab7cce0ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2011-3870.ymlghsaWEB
- puppet.com/security/cve/cve-2011-3870nvdWEB
News mentions
0No linked articles in our index yet.