[ubuntu/trusty-security] puppet 3.4.3-1ubuntu1.2 (Accepted)

[Marc Deslauriers]

puppet (3.4.3-1ubuntu1.2) trusty-security; urgency=medium

  * SECURITY UPDATE: untrusted search path vulnerability
    - debian/patches/CVE-2014-3248.patch: remove current directory from
      load path in bin/puppet.
    - CVE-2014-3248
  * SECURITY UPDATE: code execution via unsafe fact formats
    - debian/patches/CVE-2017-2295.patch: reject all fact formats except
      PSON in lib/puppet/indirector/catalog/compiler.rb, added tests to
      spec/unit/indirector/catalog/compiler_spec.rb.
    - CVE-2017-2295

Date: 2017-06-02 14:49:15.846137+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/puppet/3.4.3-1ubuntu1.2
-------------- next part --------------
Sorry, changesfile not available.