[Pkg-puppet-devel] Bug#1023625: puppet-module-puppetlabs-apt: CVE-2022-3275

[Moritz Mühlenhoff]

Source: puppet-module-puppetlabs-apt
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for puppet-module-puppetlabs-apt.

CVE-2022-3275[0]:
| Command injection is possible in the puppetlabs-apt module prior to
| version 9.0.0. A malicious actor is able to exploit this vulnerability
| only if they are able to provide unsanitized input to the module. This
| condition is rare in most deployments of Puppet and Puppet Enterprise.

https://puppet.com/security/cve/CVE-2022-3275
https://github.com/puppetlabs/puppetlabs-apt/commit/c26ad2a54f318b4d6fbe55f837b00cd6afd9f1eb

This doesn't warrant a DSA (but could be fixed via spu)

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-3275
    https://www.cve.org/CVERecord?id=CVE-2022-3275

Please adjust the affected versions in the BTS as needed.