By using the `resource_type` service, an attacker could cause puppet to load
arbitrary Ruby files from the puppet master node's file system. While this behavior is not
enabled by default, `auth.conf` settings could be modified to allow it. The exploit requires
local file system access to the Puppet Master.
Status:
Affected software versions:
Resolved in:
Affected Versions: Puppet 2.x (2.7.22 and earlier), 3.x (3.2.3 and earlier) | Puppet Enterprise 2.8.2 and earlier, 3.0.0
