Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Puppet may let local users replace any file
published 12 years ago
Summary
The Puppet software on your systems can be tricked by a user with local access to replace important files with ones they choose. This could allow unwanted changes or malicious code to run on your servers. Update Puppet to the latest version to close this gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | puppet | <= 7.34.0-1 |
Original advisory text
CVE-2013-4969 affecting package puppet 7.34.0-1
Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
References
Timeline
Published7 Jan 2014
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-45426 · OSV
Track software like this
Free during beta