Security update for puppet

SUSE Security Update: Security update for puppet
Announcement ID: SUSE-SU-2018:0571-1
Rating: moderate
References: #1080288
Affected Products:
  • SUSE Linux Enterprise Module for Advanced Systems Management 12
  • SUSE Linux Enterprise Desktop 12-SP3
  • SUSE Linux Enterprise Desktop 12-SP2
    		•

    An update that fixes one vulnerability is now available.

    Description:

    This update for puppet fixes the following issues:

    - CVE-2017-10689: Reset permissions when unpacking tar in PMT. When using
    minitar, files were unpacked with whatever permissions are in the
    tarball. This is potentially unsafe, as tarballs can be easily created
    with weird permissions (bsc#1080288)

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Module for Advanced Systems Management 12:
      zypper in -t patch SUSE-SLE-Module-Adv-Systems-Management-12-2018-379=1
    • SUSE Linux Enterprise Desktop 12-SP3:
      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-379=1
    • SUSE Linux Enterprise Desktop 12-SP2:
      zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-379=1

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Linux Enterprise Module for Advanced Systems Management 12 (ppc64le s390x x86_64):
      • puppet-3.8.5-15.9.1
      • puppet-server-3.8.5-15.9.1
    • SUSE Linux Enterprise Desktop 12-SP3 (x86_64):
      • puppet-3.8.5-15.9.1
    • SUSE Linux Enterprise Desktop 12-SP2 (x86_64):
      • puppet-3.8.5-15.9.1

    References: