puppetlabs/puppetlabs-cve20113872 — Issue #66: $PATH trickery isn't right.
Author: nigelkersten
Created: 2011-10-24 15:51:36+00:00
State: open

```
root@dev1-debian6:~# echo $PATH/var/lib/gems/1.8/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
root@dev1-debian6:~# export PATH="${CVE_PATH:-'/opt/puppet/bin'}:$PATH"root@dev1-debian6:~# echo $PATH
'/opt/puppet/bin':/var/lib/gems/1.8/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
```

instead:

```
root@dev1-debian6:~# echo $PATH/var/lib/gems/1.8/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
root@dev1-debian6:~# export PATH="${CVE_PATH:-/opt/puppet/bin}:$PATH"root@dev1-debian6:~# echo $PATH
/opt/puppet/bin:/var/lib/gems/1.8/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
```

note the quoting change.