Moderate severityNVD Advisory· Published Oct 27, 2011· Updated Jun 16, 2026
CVE-2011-3871
CVE-2011-3871
Description
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
puppetRubyGems | >= 2.7.0, < 2.7.5 | 2.7.5 |
puppetRubyGems | < 2.6.11 | 2.6.11 |
Affected products
24cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*+ 22 more
- cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.4:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.5:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:0.25.6:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
14- groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cbnvdPatchWEB
- lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.htmlnvdPatchWEB
- lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.htmlnvdPatchWEB
- lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.htmlnvdPatchWEB
- secunia.com/advisories/46458nvdVendor Advisory
- github.com/advisories/GHSA-mpmx-gm5v-q789ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2011-3871ghsaADVISORY
- www.debian.org/security/2011/dsa-2314nvdWEB
- www.ubuntu.com/usn/USN-1223-1nvdWEB
- www.ubuntu.com/usn/USN-1223-2nvdWEB
- github.com/puppetlabs/puppet/commit/343c7bd381b63e042d437111718918f951d9b30dghsaWEB
- github.com/puppetlabs/puppet/commit/d76c30935460ded953792dfe49f72b8c5158e899ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2011-3871.ymlghsaWEB
- puppet.com/security/cve/cve-2011-3871nvdWEB
News mentions
0No linked articles in our index yet.