CVE-2009-3564
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a...
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
Exploit likelihood
What each source reports
NVD Score used
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
CVE-2009-3564- CVSS 2.0
- 4.7 Medium
AV:L/AC:M/Au:N/C:C/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
CVE-2009-3564- Updated
- 2026-11-02
EUVDEUVD-2009-3545No score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
EUVD-2009-3545- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6384-2w9h-qw8wNo score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a...
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
GHSA-6384-2w9h-qw8w- Updated
- 2026-11-02
OSVNo score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
CVE-2009-3564- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3564No score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
DEBIAN-CVE-2009-3564- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetDebian:11 | before 0.25.1-3 | 0.25.1-3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3564 is a medium vulnerability (CVSS 4.7) in Reductivelabs Puppet, published October 6, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in puppet 0.25.1-3.