CVE-2024-27294

    Dashboard / Vulnerabilities / CVE-2024-27294

    CVE-2024-27294

    Published: 29 Feb 2024Last Modified: 12 Aug 2026

    Summary: dp-golang Go installation could be owned by wrong user

    Details: dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27294.json, https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84, https://nvd.nist.gov/vuln/detail/CVE-2024-27294, https://github.com/danielparks/puppet-golang/commit/1d0865b24071cb1c00d2fd8cb755d444e6e8f888, https://github.com/danielparks/puppet-golang/commit/870724a7fef50208515da7bbfa9dfd5d6950e7f5

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -7457468895d8e1473f87f41fec7c660ef2e8b476

    Affected versions

    v1.2.6
    v1.2.5
    v1.2.4
    v1.2.3
    v1.2.2
    v1.2.1
    v1.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-27294 | CVE-DB