PT-2024-21801 · Puppet+1 · Puppet+1

CVE-2024-27294 · Published 2024-02-29 · Updated 2024-03-01

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dp-golang versions prior to 1.2.7

Description The issue arises when dp-golang is used to install Go, potentially leading to files being installed with incorrect ownership. This occurs when Puppet is run as root and the installed package is on macOS, with Go versions ranging from 1.4.3 through 1.21rc3. The user and group specified in Puppet code are ignored for files within the archive.

Recommendations For versions prior to 1.2.7, update to dp-puppet version 1.2.7, which will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2024-27294

GHSA-8H8M-H98F-VV84

Affected Products

Puppet

Dp-Golang

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27294.json · Exploit
• https://github.com/danielparks/puppet-golang/commit/1d0865b24071cb1c00d2fd8cb755d444e6e8f888 · Patch
• https://github.com/danielparks/puppet-golang/commit/870724a7fef50208515da7bbfa9dfd5d6950e7f5 · Patch
• https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27294 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27294 · Security Note
• https://twitter.com/CVEnew/status/1763342832486805940 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1763378879748547039 · Twitter Post