CVE-2024-27294: Insufficient Information (NVD-CWE-noinfo)
value: dp-golang is a Puppet module for Go installations.  Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-29T23:15Z
Repository: https://github.com/danielparks/puppet-golang
Language: Other
Files changed: CHANGELOG.md, manifests/from_tarball.pp
Commit date: 2024-02-29 12:18:27 -0800
Commit message: Security: ignore file ownership when extracting Go

Certain Go tarballs specified that some files, such as the `go` binary,
were supposed to be owned by a non-root user. When running as root,
dp-golang extracted those files and preserved ownership, which lead to
those files being writable by a non-root user.

Affected Go tarballs:

  * Go for macOS version 1.4.3 through 1.21rc3, inclusive.
  * go1.4-bootstrap-20170518.tar.gz
  * go1.4-bootstrap-20170531.tar.gz

This switches to extracting the tarballs with `tar`’s `--no-same-owner`
and `--no-same-permissions` flags.

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 207d489..f913821 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,42 @@
 
 All notable changes to this project will be documented in this file.
 
 ## main branch
 
+### Security fix
+
+Certain Go tarballs (see below) had files owned by non-root users:
+
+    ❯ curl -SsL https://go.dev/dl/go1.20.14.darwin-amd64.tar.gz | tar -tzvf - | head -3
+    drwxr-xr-x  0 0      0           0 Feb  2 10:19 go/
+    -rw-r--r--  0 gopher wheel    1339 Feb  2 10:09 go/CONTRIBUTING.md
+    -rw-r--r--  0 gopher wheel    1479 Feb  2 10:09 go/LICENSE
+
+In this case, the non-root user in question mapped to the first user created on
+the macOS system (UID 501).
+
+When running as root, previous versions of dp-golang would preserve file
+ownership when extracting the tarball, even if `owner` was set to something
+else. **This meant that files, such as the `go` binary, ended up being writable
+by a non-root user.**
+
+This version of dp-golang enables [`tar`]’s `--no-same-owner` and
+`--no-same-permissions` flags, which cause files to be extracted as the user
+running Puppet, or as the user/group specified in the Puppet code.
+
+GitHub security advisory: [GHSA-8h8m-h98f-vv84]
+
+#### Affected Go tarballs
+
+  * Go for macOS version 1.4.3 through 1.21rc3, inclusive.
+  * go1.4-bootstrap-20170518.tar.gz
+  * go1.4-bootstrap-20170531.tar.gz
+
+[`tar`]: https://www.man7.org/linux/man-pages/man1/tar.1.html
+[GHSA-8h8m-h98f-vv84]: https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84
+
 ## Release 1.2.6
 
 * Synced with [PDK][].
 
 [PDK]: https://www.puppet.com/docs/pdk/latest/pdk.html
diff --git a/manifests/from_tarball.pp b/manifests/from_tarball.pp
index fdc1650..6c2521a 100644
--- a/manifests/from_tarball.pp
+++ b/manifests/from_tarball.pp
@@ -107,11 +107,11 @@ define golang::from_tarball (
 
     archive { $archive_path:
       ensure        => present,
       extract       => true,
       extract_path  => $go_dir,
-      extract_flags => '--strip-components 1 -xf',
+      extract_flags => '--strip-components 1 --no-same-owner --no-same-permissions -xf',
       user          => $owner,
       group         => $group,
       source        => $source,
       creates       => "${go_dir}/bin",
       cleanup       => true,

Vulnerable code:       extract_flags => '--strip-components 1 -xf',
Fixed code: ### Security fix

Certain Go tarballs (see below) had files owned by non-root users:

    ❯ curl -SsL https://go.dev/dl/go1.20.14.darwin-amd64.tar.gz | tar -tzvf - | head -3
    drwxr-xr-x  0 0      0           0 Feb  2 10:19 go/
    -rw-r--r--  0 gopher wheel    1339 Feb  2 10:09 go/CONTRIBUTING.md
    -rw-r--r--  0 gopher wheel    1479 Feb  2 10:09 go/LICENSE

In this case, the non-root user in question mapped to the first user created on
the macOS system (UID 501).

When running as root, previous versions of dp-golang would preserve file
ownership when extracting the tarball, even if `owner` was set to something
else. **This meant that files, such as the `go` binary, ended up being writable
by a non-root user.**

This version of dp-golang enables [`tar`]’s `--no-same-owner` and
`--no-same-permissions` flags, which cause files to be extracted as the user
running Puppet, or as the user/group specified in the Puppet code.

GitHub security advisory: [GHSA-8h8m-h98f-vv84]

#### Affected Go tarballs

  * Go for macOS version 1.4.3 through 1.21rc3, inclusive.
  * go1.4-bootstrap-20170518.tar.gz
  * go1.4-bootstrap-20170531.tar.gz

[`tar`]: https://www.man7.org/linux/man-pages/man1/tar.1.html
[GHSA-8h8m-h98f-vv84]: https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84

      extract_flags => '--strip-components 1 --no-same-owner --no-same-permissions -xf',