Jira (PUP-11596) CVE-2022-28738: Puppet-agent 5.5.x and 6.x releases

[Sanjay Tripathi (Jira)]

Sanjay Tripathi created an issue

Puppet / PUP-11596 CVE-2022-28738: Puppet-agent 5.5.x and 6.x releases Issue Type: Bug Affects Versions: PUP 6.25.1, PUP 6.16.0, PUP 5.5.14 Assignee: Unassigned Created: 2022/07/25 10:16 AM Priority: Blocker Reporter: Sanjay Tripathi Puppet Version: 5.5.14, 6.16.0, 6.25.1 Puppet Server Version: N/A OS Name/Version: ALL Ruby has released fixes for CVE-2022-28738.  When does Puppet plan to address Ruby CVE-2022-28738 for older version of Puppet-Agent? We use 5.5.14, 6.16.0 and 6.25.1 Open-Source Puppet-agents and would like to know Puppet's plans to address CVE-2022-28738 in these older Puppet-agent versions. Thanks. Add Comment

This message was sent by Atlassian Jira (v8.20.11#820011-sha1:0629dd8)

[Josh Cooper (Jira)]

Josh Cooper commented on PUP-11596

Re: CVE-2022-28738: Puppet-agent 5.5.x and 6.x releases Sanjay Tripathi Ruby CVE-2022-28738 only affects Ruby 3.x but Puppet vendors Ruby versions before that, so we are unaffected.

Add Comment

[Sanjay Tripathi (Jira)]

Sanjay Tripathi commented on PUP-11596

Re: CVE-2022-28738: Puppet-agent 5.5.x and 6.x releases

Thank you for the clarification, Josh Cooper

Add Comment