CVE-2011-3869
Puppet arbitrary file overwrite
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
Exploit likelihood
What each source reports
NVD Score used
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
- Record
CVE-2011-3869- CVSS 2.0
- 6.3 Medium
AV:L/AC:M/Au:N/C:N/I:C/A:C - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
- Record
CVE-2011-3869- Updated
- 2026-11-02
EUVDEUVD-2022-3160 No score
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
- Record
EUVD-2022-3160- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8c56-v25w-f89c No score
Puppet arbitrary file overwrite
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
- Record
GHSA-8c56-v25w-f89c- Weakness
- CWE-59
- Updated
- 2026-11-02
OSV No score
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
- Record
CVE-2011-3869- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-3869 No score
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
- Record
DEBIAN-CVE-2011-3869- Updated
- 2026-11-02
OSVGHSA-8c56-v25w-f89c No score
Puppet arbitrary file overwrite
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
- Record
GHSA-8c56-v25w-f89c- Weakness
- CWE-59
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetRubyGems |
before 2.6.11 | 2.6.11 |
puppetRubyGems |
2.7.0 up to 2.7.5 | 2.7.5 |
puppetDebian:11 |
before 2.7.3-3 | 2.7.3-3 |
puppetDebian:6.0 |
before 2.6.2-5+squeeze1, plus listed versions 2.6.2-42.6.2-5 |
2.6.2-5+squeeze1 |
puppetRubyGems |
2.7.0 up to 2.7.5, plus listed versions 2.7.12.7.32.7.4 |
2.7.5 |
puppetRubyGems |
before 2.6.11, plus listed versions 0.13.00.13.10.13.20.13.60.16.0 Show 33 moreShow less0.18.40.22.40.23.00.23.10.23.20.24.00.24.10.24.20.24.30.24.40.24.50.24.60.24.70.24.80.24.90.25.00.25.10.25.20.25.30.25.40.25.50.9.22.6.02.6.12.6.102.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.9 |
2.6.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-3869 is a medium vulnerability (CVSS 6.3) in Puppet, published September 29, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in puppet 2.6.11.
References
lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html
debian.org/security/2011/dsa-2314
secunia.com/advisories/46458
groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb
Show 10 moreShow less
ubuntu.com/usn/USN-1223-1
puppet.com/security/cve/cve-2011-3869
nvd.nist.gov/vuln/detail/CVE-2011-3869
github.com/puppetlabs/puppet/commit/2775c21ae48e189950dbea5e7b4d1d9fa2aca41c
security-tracker.debian.org/tracker/CVE-2011-3869