Security update for rubygem-puppet SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0602-1 Final 1 1 2018-03-05T09:41:06Z current 2018-03-05T09:41:06Z 2018-03-05T09:41:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-puppet This update for rubygem-puppet fixes the following issues: - CVE-2017-10689: Reset permissions when unpacking tar in PMT. When using minitar, files were unpacked with whatever permissions are in the tarball. This is potentially unsafe, as tarballs can be easily created with weird permissions (bsc#1080288) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Adv-Systems-Management-12-2018-409 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180602-1/ Link for SUSE-SU-2018:0602-1 https://lists.suse.com/pipermail/sle-security-updates/2018-March/003785.html E-Mail link for SUSE-SU-2018:0602-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1080288 SUSE Bug 1080288 https://www.suse.com/security/cve/CVE-2017-10689/ SUSE CVE CVE-2017-10689 page SUSE Linux Enterprise Module for Advanced Systems Management 12 ruby2.1-rubygem-puppet-4.8.1-32.3.1 rubygem-puppet-4.8.1-32.3.1 ruby2.1-rubygem-puppet-4.8.1-32.3.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 rubygem-puppet-4.8.1-32.3.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability. CVE-2017-10689 SUSE Linux Enterprise Module for Advanced Systems Management 12:ruby2.1-rubygem-puppet-4.8.1-32.3.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:rubygem-puppet-4.8.1-32.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180602-1/ https://www.suse.com/security/cve/CVE-2017-10689.html CVE-2017-10689 https://bugzilla.suse.com/1080288 SUSE Bug 1080288