UBUNTU-CVE-2022-3275
Dashboard / Vulnerabilities / UBUNTU-CVE-2022-3275
Summary:
Details: Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
References: https://ubuntu.com/security/CVE-2022-3275, https://puppet.com/security/cve/CVE-2022-3275, https://github.com/puppetlabs/puppetlabs-apt/compare/v8.5.0...v9.0.0, https://github.com/puppetlabs/puppetlabs-apt/pull/1052, https://www.cve.org/CVERecord?id=CVE-2022-3275
Affected packages
Package
Name: puppet-module-puppetlabs-apt
Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
1.6.0-2
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
