[ GLSA 201412-45 ] Facter

[GLSA]

Gentoo Linux Security Advisory

Title: Facter: Privilege escalation (GLSA 201412-45)
Severity: high
Exploitable: local
Date: December 26, 2014
Bug(s): #514476
ID: 201412-45

Synopsis

An untrusted search path vulnerability in Facter could lead to
local privilege escalation.


Background

Facter is a cross-platform Ruby library for retrieving facts from
operating systems.


Affected Packages

Package: dev-ruby/facter
Vulnerable: < 1.7.6
Unaffected: >= 1.7.6
Architectures: All supported architectures


Description

Facter includes the current working directory in the search path.

Impact

A local attacker may be able to gain escalated privileges.

Workaround

There is no known workaround at this time.

Resolution

All Facter users should upgrade to the latest version: