PT-2022-21443 · Puppet+1 · Puppetlabs-Apt+1

Published 2022-10-07 · Updated 2023-06-29 · CVE-2022-3275

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions puppetlabs-apt versions prior to 9.0.0

Description Command injection is possible in the puppetlabs-apt module. A malicious actor can exploit this issue if they can provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.

Recommendations For versions prior to 9.0.0, update to version 9.0.0 or later to resolve the issue. As a temporary workaround, consider sanitizing all input to the puppetlabs-apt module to prevent command injection. Restrict access to the module to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-3275

Affected Products

Debian

Puppetlabs-Apt

References · 13

• https://puppet.com/security/cve/CVE-2022-3275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3275 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3275 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3275 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3275 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CH4NUKZKPY4MFQHFBTONJK2AWES4DFDA · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3275 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR5LIOF5VKS4DC2NQWXTMPPXOYJC46XC · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3275 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-3275 · Vendor Advisory
• https://github.com/puppetlabs/puppetlabs-apt/pull/1052 · Note
• https://github.com/puppetlabs/puppetlabs-apt/compare/v8.5.0...v9.0.0 · Note
• https://t.me/cibsecurity/51030 · Telegram Post