{"id":"CVE-2013-4956","aliases":["DEBIAN-CVE-2013-4956","DSA-2761-1","EUVD-2013-4800","GHSA-3jgg-vqj7-2c3r","MGASA-2013-0259","RHSA-2013:1283","RHSA-2013:1284","openSUSE-SU-2024:10581-1"],"status":"published","title":"Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and...","description":"Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.","severity":{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00381,"percentile":0.32343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-08-20T22:00:00Z","modified":"2026-08-04T06:03:46Z","fixes":[{"ecosystem":"Debian:11","package":"puppet","fixed_in":["3.2.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.23-1~deb7u1"}]}],"versions":["2.7.18-4","2.7.18-5"],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.23-1.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.23-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"puppet3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"facter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"hiera","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.4-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"puppet-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.4-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-augeas-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-13.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-shadow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-13.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby193-puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-11.1.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby193-puppet-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-11.1.el6ost"}]}],"bundled":3}],"products":[{"vendor":"puppet","product":"puppet"},{"vendor":"puppet","product":"puppet_enterprise"},{"vendor":"puppetlabs","product":"puppet"}],"references":[{"url":"http://www.debian.org/security/2013/dsa-2761","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4956/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1284.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1283.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4956","tags":["advisory"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4956","tags":["article"]},{"url":"https://github.com/advisories/GHSA-3jgg-vqj7-2c3r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4956","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0259.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11019","tags":["report"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4761/","tags":["web","article"]},{"url":"http://www.ubuntu.com/usn/usn-1928-1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1283","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=974649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996856","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1283.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-3567","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3567","tags":["advisory"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-3567/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4761","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4761","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4956","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1284","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-3567","tags":["article"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4761","tags":["article"]},{"url":"https://access.redhat.com/support/offerings/techpreview/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1284.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3253","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4956","description":"Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.","status":"published","published":"2013-08-20T22:00:00Z","modified":"2024-08-06T16:59:40.991Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4800","description":"Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.","status":"published","published":"2013-08-20T22:00:00Z","modified":"2024-08-06T16:59:40Z","updated_at":"2026-11-03T01:56:30.109549Z"}],"ghsa":[{"id":"GHSA-3jgg-vqj7-2c3r","title":"Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and...","description":"Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.","status":"published","published":"2022-05-14T00:56:50Z","modified":"2025-04-11T04:14:04Z","updated_at":"2026-11-02T15:01:14.490744Z"}],"nvd":[{"id":"CVE-2013-4956","description":"Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.","status":"published","published":"2013-08-20T22:55:04.4Z","modified":"2026-06-16T23:58:09.68Z","cvss":[{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"CVE-2013-4956","description":"Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.","status":"published","published":"2013-08-20T22:55:04Z","modified":"2026-04-16T06:17:07.872392996Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4956","description":"Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.","status":"published","published":"2013-08-20T22:55:04.4Z","modified":"2026-08-04T06:03:46.219357506Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2761-1","title":"puppet - several","status":"published","published":"2013-09-19T00:00:00Z","modified":"2026-03-09T01:20:34.881871Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0259","title":"Updated puppet and puppet3 package fix security vulnerabilities","description":"It was discovered that Puppet incorrectly handled the resource_type\nservice. A local attacker on the master could use this issue to execute\narbitrary Ruby files (CVE-2013-4761).\n\nIt was discovered that Puppet incorrectly handled permissions on the\nmodules it installed. Modules could be installed with the permissions\nthat existed when they were built, possibly exposing them to a local\nattacker (CVE-2013-4956).\n","status":"published","published":"2013-08-26T19:44:50Z","modified":"2026-04-16T06:26:13.602920498Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10581-1","title":"ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-puppet-3.8.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:42.396541Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2013:1283","title":"Red Hat Security Advisory: puppet security update","status":"published","published":"2024-09-15T21:06:08Z","modified":"2026-06-28T10:08:34Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:1284","title":"Red Hat Security Advisory: ruby193-puppet security update","status":"published","published":"2024-09-15T21:06:13Z","modified":"2026-06-28T10:08:35Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}