GCVE - cpe:2.3:a:puppet:puppet:0.25.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:puppet:puppet:0.25.5:*:*:*:*:*:*:*

part: a version: 0.25.5 update: *

Vendor	Puppet (`056a1ba3-12b3-5ecf-a97f-ab3b403c7816`)
Product	Puppet (`7d8fb82a-9b62-59b4-94cc-efb68e8fe2b8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/puppet`	purl2cpe	2026-06-01 10:14:37.052812
`pkg:deb/ubuntu/puppet`	purl2cpe	2026-06-01 10:14:37.052813
`pkg:github/puppetlabs/puppet`	purl2cpe	2026-06-01 10:14:37.052815
`pkg:puppet/open-source-puppet`	purl2cpe	2026-06-01 10:14:37.052816
`pkg:rpm/fedora/puppet`	purl2cpe	2026-06-01 10:14:37.052818
`pkg:rpm/opensuse/puppet`	purl2cpe	2026-06-01 10:14:37.052819

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2011-3871`	vulnerable	2026-06-03 14:31:22.088249	Details available Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files. Published: 2011-10-27T20:00:00.000Z Updated: 2024-08-06T23:53:31.193Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html http://www.debian.org/security/2011/dsa-2314 http://secunia.com/advisories/46458 https://puppet.com/security/cve/cve-2011-3871	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3870`	vulnerable	2026-06-03 14:31:22.087355	Details available Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file. Published: 2011-10-27T20:00:00.000Z Updated: 2024-08-06T23:53:31.428Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html https://puppet.com/security/cve/cve-2011-3870 http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html http://www.debian.org/security/2011/dsa-2314 http://secunia.com/advisories/46458	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3869`	vulnerable	2026-06-03 14:31:22.085890	Details available Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file. Published: 2011-10-27T20:00:00.000Z Updated: 2024-08-06T23:53:31.193Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html http://www.debian.org/security/2011/dsa-2314 http://secunia.com/advisories/46458 http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.