CVE-2024-27294

dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group

• CWE-732
• CWE-732

• https://github.com/danielparks/puppet-golang/commit/1d0865b24071cb1c00d2fd8cb755d444e6e8f888Patch
• https://github.com/danielparks/puppet-golang/commit/870724a7fef50208515da7bbfa9dfd5d6950e7f5Patch
• https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84Vendor Advisory
• https://github.com/danielparks/puppet-golang/commit/1d0865b24071cb1c00d2fd8cb755d444e6e8f888Patch
• https://github.com/danielparks/puppet-golang/commit/870724a7fef50208515da7bbfa9dfd5d6950e7f5Patch
• https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84Vendor Advisory

Published

Feb 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-272881Panel is an open source Linux server operation and maintena…3.1
• CVE-2024-27289pgx is a PostgreSQL driver and toolkit for Go. Prior to vers…8.1
• CVE-2024-2729The Otter Blocks WordPress plugin before 2.6.6 does not pro…6.1
• CVE-2024-27290Docassemble is an expert system for guided interviews and do…6.1
• CVE-2024-27291Docassemble is an expert system for guided interviews and do…6.1
• CVE-2024-27292Docassemble is an expert system for guided interviews and do…7.5
• CVE-2024-27295Directus is a real-time API and App dashboard for managing S…8.2
• CVE-2024-27296Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2024-27297Nix is a package manager for Linux and other Unix systems. A…5.9
• CVE-2024-27298parse-server is a Parse Server for Node.js / Express. This v…10
• CVE-2024-27299phpMyFAQ is an open source FAQ web application for PHP 8.1+ …8.8
• CVE-2024-2730Mautic uses predictable page indices for unpublished landing…5.3