SUSE-SU-2018:0602-1: moderate: Security update for rubygem-puppet

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for rubygem-puppet
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:0602-1
Rating:             moderate
References:         #1080288 
Cross-References:   CVE-2017-10689
Affected Products:
                    SUSE Linux Enterprise Module for Advanced Systems Management 12
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update for rubygem-puppet fixes the following issues:

   - CVE-2017-10689: Reset permissions when unpacking tar in PMT. When using
     minitar, files were unpacked with whatever permissions are in the
     tarball. This is potentially unsafe, as tarballs can be easily created
     with weird permissions (bsc#1080288)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Advanced Systems Management 12:

      zypper in -t patch SUSE-SLE-Module-Adv-Systems-Management-12-2018-409=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Module for Advanced Systems Management 12 (ppc64le s390x x86_64):

      ruby2.1-rubygem-puppet-4.8.1-32.3.1
      rubygem-puppet-4.8.1-32.3.1


References:

   https://www.suse.com/security/cve/CVE-2017-10689.html
   https://bugzilla.suse.com/1080288