VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published May 29, 2012· Updated Apr 29, 2026

CVE-2012-1053

CVE-2012-1053

Description

The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
puppetRubyGems
>= 2.6, < 2.6.142.6.14
puppetRubyGems
>= 2.7, < 2.7.112.7.11

Affected products

35
  • Puppetlabs/Puppet2 versions
    cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
  • Puppetlabs/Puppet Enterprise Users2 versions
    cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:*:*:*:*:*:*:*
  • Puppet (software)/Puppet23 versions
    cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*+ 22 more
    • cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*
  • Puppet (software)/Puppet Enterprise8 versions
    cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet_enterprise:1.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet_enterprise:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet_enterprise:2.0.2:*:*:*:*:*:*:*

Patches

1
76d0749f0a9a

(#12459) drop supplementary groups when permanently dropping UID

https://github.com/puppetlabs/puppetDaniel PittmanFeb 5, 2012via ghsa
commit
2 files changed · +7 −2
  • lib/puppet/util/suidmanager.rb+5 −2 modified
    @@ -93,11 +93,14 @@ def change_user(user, permanently=false)
     raise Puppet::Error, "No such user #{user}" unless uid
 
     if permanently
+      # If changing uid, we must be root. So initgroups first here.
+      initgroups(uid)
+
       begin
+        # Prefer the better `change_privilege` method, but if that fails us,
+        # fall back to directly setting the values.
         Process::UID.change_privilege(uid)
       rescue NotImplementedError
-        # If changing uid, we must be root. So initgroups first here.
-        initgroups(uid)
         Process.euid = uid
         Process.uid  = uid
       end
  • spec/unit/util/suidmanager_spec.rb+2 −0 modified
    @@ -165,6 +165,8 @@
           Process.euid = uid
         end
 
+        Puppet::Util::SUIDManager.expects(:initgroups).with(42)
+
         Puppet::Util::SUIDManager.change_user(42, true)
 
         xids[:euid].should == 42

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

27

News mentions

0

No linked articles in our index yet.