CVE-2017-10689: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

Affected products

• Canonical Ubuntu Linux: version 14.04 only
• Puppet Puppet: before 5.3.4 (fixed in 5.3.4); from 1.10.0, before 1.10.10 (fixed in 1.10.10)
• Puppet Puppet Enterprise: before 2016.4.10 (fixed in 2016.4.10); from 2017.1.0, before 2017.3.4 (fixed in 2017.3.4)
• Red Hat Satellite: version 6.4 only

Published 2018-02-09. Last modified 2026-06-17.