CVE-2014-3248
facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability
CVE-2014-3248 is a medium vulnerability (CVSS 6.2) in Puppet Facter, published June 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in facter 1.7.6.
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
Exploit likelihood
What each source reports
NVD Score used
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
- Record
CVE-2014-3248- CVSS 2.0
- 6.2 Medium
AV:L/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-17
- Updated
- 2026-11-02
CVE List No score
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
- Record
CVE-2014-3248- Updated
- 2026-11-02
EUVDEUVD-2017-0196 No score
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
- Record
EUVD-2017-0196- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92v7-pq4h-58j5 No score
facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
- Record
GHSA-92v7-pq4h-58j5- Updated
- 2026-11-02
OSV No score
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
- Record
CVE-2014-3248- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3248 No score
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
- Record
DEBIAN-CVE-2014-3248- Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-92v7-pq4h-58j5 No score
facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
- Record
GHSA-92v7-pq4h-58j5- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10565-1 No score
ruby2.2-rubygem-facter-2.4.6-2.1 on GA media
These are all security issues fixed in the ruby2.2-rubygem-facter-2.4.6-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10565-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10581-1 No score
ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media
These are all security issues fixed in the ruby2.2-rubygem-puppet-3.8.7-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10581-1- Updated
- 2026-11-02
OSVSUSE-RU-2015:0696-1 No score
Security update for puppet
Puppet was updated to fix the following security issues:
* Unsafe use of temporary files. (CVE-2013-4969)
* Arbitrary code execution with required social engineering.
(CVE-2014-3248, CVE-2014-3250)
Security Issues references:
* CVE-2014-3248
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3248>
* CVE-2013-4969
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4969>
* CVE-2014-3250
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3250>
- Record
SUSE-RU-2015:0696-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3248 No score
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
- Record
UBUNTU-CVE-2014-3248- Updated
- 2026-11-02
OSVUSN-3308-1 No score
puppet vulnerabilities
Dennis Rowe discovered that Puppet incorrectly handled the search path. A local attacker could use this issue to possibly execute arbitrary code. (CVE-2014-3248)
It was discovered that Puppet incorrectly handled YAML deserialization. A remote attacker could possibly use this issue to execute arbitrary code on the master. This update is incompatible with agents older than 3.2.2. (CVE-2017-2295)
- Record
USN-3308-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
facterRubyGems |
before 1.7.6 | 1.7.6 |
facterRubyGems |
2.0.0 up to 2.0.2 | 2.0.2 |
hieraRubyGems |
before 1.3.4 | 1.3.4 |
puppetRubyGems |
before 2.7.26 | 2.7.26 |
puppetRubyGems |
3.0.0 up to 3.6.2 | 3.6.2 |
mcollective-clientRubyGems |
before 2.5.2 | 2.5.2 |
facterDebian:12 |
before 2.0.1-1 | 2.0.1-1 |
facterDebian:13 |
before 2.0.1-1 | 2.0.1-1 |
hieraDebian:12 |
before 1.3.4-1 | 1.3.4-1 |
hieraDebian:13 |
before 1.3.4-1 | 1.3.4-1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
hieraDebian:14 |
before 1.3.4-1 | 1.3.4-1 |
mcollectiveDebian:12 |
before 2.5.2+dfsg-1 | 2.5.2+dfsg-1 |
facterRubyGems |
before 1.7.6, plus listed versions 1.0.11.1.11.3.31.3.71.3.8 Show 45 moreShow less1.51.5.21.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.12.rc11.6.12.rc21.6.131.6.13.rc11.6.141.6.14.rc11.6.151.6.15.rc11.6.161.6.171.6.17.rc11.6.181.6.18.rc11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.0.rc11.7.0.rc21.7.11.7.1.rc11.7.21.7.2.rc11.7.31.7.3.rc11.7.4 |
1.7.6 |
facterRubyGems |
2.0.0 up to 2.0.2, plus listed versions 2.0.12.0.1.rc12.0.1.rc22.0.1.rc32.0.1.rc4 |
2.0.2 |
hieraRubyGems |
before 1.3.4, plus listed versions 0.1.00.1.10.2.00.3.01.0.0 Show 22 moreShow less1.0.0rc41.1.01.1.0.rc11.1.11.1.1.rc11.1.21.1.2.rc11.1.2.rc21.2.01.2.0.rc11.2.0.rc21.2.0.rc31.2.11.2.1.rc11.3.01.3.0.rc21.3.11.3.1.rc11.3.21.3.2.rc11.3.2.rc21.3.3 |
1.3.4 |
puppetRubyGems |
before 2.7.26, plus listed versions 0.13.00.13.10.13.20.13.60.16.0 Show 45 moreShow less0.18.40.22.40.23.00.23.10.23.20.24.00.24.10.24.20.24.30.24.40.24.50.24.60.24.70.24.80.24.90.25.00.25.10.25.20.25.30.25.40.25.50.9.22.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.172.6.182.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.12.7.112.7.122.7.13 |
2.7.26 |
puppetRubyGems |
3.0.0 up to 3.6.2, plus listed versions 3.0.13.0.1.rc13.0.23.0.2.rc13.0.2.rc2 Show 35 moreShow less3.0.2.rc33.1.03.1.0.rc13.1.0.rc23.1.13.2.0.rc13.2.0.rc23.2.13.2.1.rc13.2.23.2.33.2.3.rc13.2.43.3.03.3.0.rc23.3.0.rc33.3.13.3.1.rc13.3.1.rc23.3.1.rc33.3.23.4.03.4.0.rc13.4.0.rc23.4.13.4.23.4.33.5.0.rc13.5.0.rc23.5.0.rc33.5.13.5.1.rc13.6.03.6.0.rc13.6.1 |
3.6.2 |
mcollective-clientRubyGems |
before 2.5.2, plus listed versions 1.3.32.0.02.2.02.2.12.2.2 Show 7 moreShow less2.2.32.2.42.4.02.4.12.5.02.5.0.rc12.5.1 |
2.5.2 |
puppetUbuntu:14.04:LTS |
before 3.4.3-1ubuntu1.2, plus listed versions 3.2.4-2ubuntu23.3.1-1ubuntu13.3.1-1ubuntu23.3.1-1ubuntu33.4.2-13.4.3-13.4.3-1ubuntu13.4.3-1ubuntu1.1 |
3.4.3-1ubuntu1.2 |
facterUbuntu:14.04:LTS |
All versions, plus listed versions 1.7.0-1ubuntu11.7.2-1ubuntu11.7.3-1ubuntu11.7.5-1ubuntu1 |
None known |
facterUbuntu:26.10 |
All versions, plus listed versions 4.10.0-1build1 |
None known |
rubygem-facteropenSUSE:Tumbleweed |
before 1.3.4-3.5 | 1.3.4-3.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
puppetlabs.com/security/cve/cve-2014-3248
secunia.com/advisories/59197
rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet
securityfocus.com/bid/68035
nvd.nist.gov/vuln/detail/CVE-2014-3248
Show 37 moreShow less
github.com/rubysec/ruby-advisory-db/blob/master/gems/facter/CVE-2014-3248.yml
web.archive.org/web/20141129061319/http://www.securityfocus.com/bid/68035
security-tracker.debian.org/tracker/CVE-2014-3248
suse.com/support/update/announcement//suse-ru-20150696-1
bugzilla.suse.com/825878
ubuntu.com/security/CVE-2014-3248
openwall.com/lists/oss-security/2014/07/08/2
cve.org/CVERecord?id=CVE-2014-3248
Left out here: 22 versions. The JSON record has them.