-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe GitHub patch shows the vulnerable code was replaced in lib/puppet/application/resource.rb, where the temporary file creation logic resided. The original code used a static /tmp path with the process ID (predictable), while the patched version switched to Tempfile.new with a secure random name. The CVE description explicitly ties the vulnerability to the --edit mode's predictable filename, which matches the code changes observed in the commit diff. No other functions are implicated in the advisory or patch details.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| puppet | rubygems | < 2.6.11 | 2.6.11 |
| puppet | rubygems | >= 2.7.0, < 2.7.5 | 2.7.5 |