# CVE-2014-3248: facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

Source: https://junglewise.ai/threats/cve-2014-3248-facter-hiera-mcollective-client-and-puppet-affected-by-untrusted  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-10-24  
License: CC BY 4.0 with a link back

CVE-2014-3248 · Severity: info · Published 2017-10-24

facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

Technologies: [puppet (RubyGems)](https://junglewise.ai/threats/technologies/puppet). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2014-3248 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2014-3248 being exploited in the wild.

**How severe is CVE-2014-3248?** Informational severity, published 24 October 2017.

**Which products and versions are affected?** facter (RubyGems) ECOSYSTEM:introduced=0,fixed=1.7.6; hiera (RubyGems) ECOSYSTEM:introduced=0,fixed=1.3.4; mcollective-client (RubyGems) ECOSYSTEM:introduced=0,fixed=2.5.2; puppet (RubyGems) ECOSYSTEM:introduced=0,fixed=2.7.26.

**Is there a fix for CVE-2014-3248?** Yes. facter (RubyGems): upgrade to 1.7.6 or later; hiera (RubyGems): upgrade to 1.3.4 or later; mcollective-client (RubyGems): upgrade to 2.5.2 or later; puppet (RubyGems): upgrade to 2.7.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2014-3248?** Check whether you run facter (RubyGems), hiera (RubyGems), mcollective-client (RubyGems) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- facter (RubyGems): upgrade to 1.7.6 or later

  ```sh
  bundle update facter
  ```

- hiera (RubyGems): upgrade to 1.3.4 or later

  ```sh
  bundle update hiera
  ```

- mcollective-client (RubyGems): upgrade to 2.5.2 or later

  ```sh
  bundle update mcollective-client
  ```

- puppet (RubyGems): upgrade to 2.7.26 or later

  ```sh
  bundle update puppet
  ```


## Affected products

- facter (RubyGems) ECOSYSTEM:introduced=0,fixed=1.7.6
- hiera (RubyGems) ECOSYSTEM:introduced=0,fixed=1.3.4
- mcollective-client (RubyGems) ECOSYSTEM:introduced=0,fixed=2.5.2
- puppet (RubyGems) ECOSYSTEM:introduced=0,fixed=2.7.26

## Identifiers

- CVE-2014-3248
- GHSA-92v7-pq4h-58j5

## Related threats

- [Puppet uses predictable filenames, allowing arbitrary file overwrite](https://junglewise.ai/threats/cve-2011-3871-puppet-uses-predictable-filenames-allowing-arbitrary-file)
- [Puppet does not properly restrict access to node resources](https://junglewise.ai/threats/cve-2011-0528-puppet-does-not-properly-restrict-access-to-node-resources)
- [Puppet arbitrary file overwrite](https://junglewise.ai/threats/cve-2011-3869-puppet-arbitrary-file-overwrite)
- [Puppet allows local users to modify the permissions of arbitrary files](https://junglewise.ai/threats/cve-2011-3870-puppet-allows-local-users-to-modify-the-permissions-of-arbitrary)
- [Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata](https://junglewise.ai/threats/cve-2015-1426-puppet-labs-facter-allows-local-users-to-obtain-sensitive-amazon)