Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

SUSE: 2013:0618-1 Critical: Puppet Software Update for Multiple Issues

suse
Calendar Grey April 3, 2013
Scroller Suse
SUSE has released a Security Update addressing various vulnerabilities in puppet. For comprehensive installation guidelines, please refer to the complete advisory.
An update that fixes 7 vulnerabilities is now available

Summary

puppet has been updated to fix 2.6.18 multiple vulnerabilities and bugs. * (#19391) Find the catalog for the specified node name * Don't assume master supports SSLv2 * Don't require openssl client to return 0 on failure * Display SSL messages so we can match our regex * Don't assume puppetbindir is defined * Remove unnecessary rubygems require * Run openssl from windows when trying to downgrade master * Separate tests for same CVEs into separate files * Fix order-dependent test failure in rest_authconfig_spec * Always read request body when using Rack * (#19392) (CVE-2013-1653) Fix acceptance test to catch unvalidated model on 2.6 * (#19392) (CVE-2013-1653) Validate indirection model in save handler * Acceptance tests for CVEs 2013 (1640, 1652, 1653, 1654, 2274, 2275)

Topics%20covered

Topics Covered

security advisory critical software update important multiple issues SUSE puppet

References

#809839

Cross- CVE-2013-1640 CVE-2013-1652 CVE-2013-1653

CVE-2013-1654 CVE-2013-1655 CVE-2013-2274

CVE-2013-2275

Affected Products:

SUSE Linux Enterprise Server 11 SP2 for VMware

SUSE Linux Enterprise Server 11 SP2

SUSE Linux Enterprise Desktop 11 SP2

https://www.suse.com/security/cve/CVE-2013-1640.html

https://www.suse.com/security/cve/CVE-2013-1652.html

https://www.suse.com/security/cve/CVE-2013-1653.html

https://www.suse.com/security/cve/CVE-2013-1654.html

https://www.suse.com/security/cve/CVE-2013-1655.html

https://www.suse.com/security/cve/CVE-2013-2274.html

https://www.suse.com/security/cve/CVE-2013-2275.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2013:0618-1
Rating: important

Topics%20covered

Topics Covered

security advisory critical software update important multiple issues SUSE puppet

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.