[ubuntu/trusty-security] puppet 3.4.3-1ubuntu1.2 (Accepted)

Marc Deslauriers marc.deslauriers at canonical.com
Mon Jun 5 16:23:50 UTC 2017

puppet (3.4.3-1ubuntu1.2) trusty-security; urgency=medium

  * SECURITY UPDATE: untrusted search path vulnerability
    - debian/patches/CVE-2014-3248.patch: remove current directory from
      load path in bin/puppet.
    - CVE-2014-3248
  * SECURITY UPDATE: code execution via unsafe fact formats
    - debian/patches/CVE-2017-2295.patch: reject all fact formats except
      PSON in lib/puppet/indirector/catalog/compiler.rb, added tests to
    - CVE-2017-2295

Date: 2017-06-02 14:49:15.846137+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
-------------- next part --------------
Sorry, changesfile not available.

More information about the Trusty-changes mailing list