CVE-2024-27294

Katalog CVE

CVSS 7.8 · High EPSS 0,23%

Kerentanan Incorrect Permission Assignment for Critical Resource pada danielparks dp-golang. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group

Rincian

Terbit di NVD

29 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84 advisory vendor
• https://github.com/danielparks/puppet-golang/commit/1d0865b24071cb1c00d2fd8cb755d444e6e8f888 patch
• https://github.com/danielparks/puppet-golang/commit/870724a7fef50208515da7bbfa9dfd5d6950e7f5 patch