CVE-2024-27294

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
danielparks	puppet-golang	< 1.2.7

References

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-272958.2Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows CVE-2024-272965.3Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number CVE-2024-272975.9Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix CVE-2024-2729810.0parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the Pos CVE-2024-272998.8phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has bee CVE-2024-27305.3Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public prev CVE-2024-273005.4phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user CVE-2024-273017.3Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstal CVE-2024-273029.1go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of dom CVE-2024-273037.3electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vul CVE-2024-273049.8pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 G CVE-2024-273055.3aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggl