mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 09:11:28 +00:00
68 lines
3.0 KiB
JSON
68 lines
3.0 KiB
JSON
{
|
|
"id": "CVE-2024-27294",
|
|
"sourceIdentifier": "security-advisories@github.com",
|
|
"published": "2024-02-29T23:15:08.250",
|
|
"lastModified": "2024-03-01T14:04:26.010",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files \u2014 including the compiler binary \u2014 with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group"
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "dp-golang es un m\u00f3dulo Puppet para instalaciones Go. Antes de 1.2.7, dp-golang pod\u00eda instalar archivos, incluido el binario del compilador, con la propiedad incorrecta cuando Puppet se ejecutaba como root y el paquete instalado era En macOS: vaya a la versi\u00f3n 1.4.3 a 1.21rc3, inclusive, go1.4 -bootstrap-20170518.tar.gz o go1.4-bootstrap-20170531.tar.gz. El usuario y el grupo especificados en el c\u00f3digo Puppet se ignoraron para los archivos dentro del archivo. La versi\u00f3n 1.2.7 de dp-puppet recrear\u00e1 las instalaciones si el propietario o grupo de cualquier archivo o directorio dentro de esa instalaci\u00f3n no coincide con el propietario o grupo solicitado."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "security-advisories@github.com",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
|
|
"attackVector": "LOCAL",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 7.3,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 1.8,
|
|
"impactScore": 5.5
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "security-advisories@github.com",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-732"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://github.com/danielparks/puppet-golang/commit/1d0865b24071cb1c00d2fd8cb755d444e6e8f888",
|
|
"source": "security-advisories@github.com"
|
|
},
|
|
{
|
|
"url": "https://github.com/danielparks/puppet-golang/commit/870724a7fef50208515da7bbfa9dfd5d6950e7f5",
|
|
"source": "security-advisories@github.com"
|
|
},
|
|
{
|
|
"url": "https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84",
|
|
"source": "security-advisories@github.com"
|
|
}
|
|
]
|
|
} |