Jira (PUP-11436) No longer used files and directories should be cleaned on upgrade

[Josh Cooper (Jira)]

Title: Message Title

Josh Cooper commented on PUP-11436   Re: No longer used files and directories should be cleaned on upgrade liam.sexton I don't believe the left behind files are a security concern because when puppet and pxp-agent services run, we explicitly manage their PATH environment variables to only include the new directory locations and trusted directories: puppet The puppet service hard codes the PATH as: C:\Program Files\Puppet Labs\Puppet\puppet\bin;C:\Program Files\Puppet Labs\Puppet\bin;%PATH% pxp-agent The pxp-agent service PATH is specified in the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pxp-agent\Parameters PATH=C:\Program Files\Puppet Labs\Puppet\puppet\bin;%PATH% So in theory there should only be an issue if one of the directories in the PATH included vulnerable components left over after the upgrade. Since these directories: "C:\program files\puppet labs\puppet\pxp-agent\bin" "C:\Program Files\Puppet Labs\Puppet\sys\ruby\bin" are not in the PATH used by either services, it should not be a problem. That said I'd recommend cleaning those up, either through a custom module or as a feature request to the puppet_agent module. Add Comment   This message was sent by Atlassian Jira (v8.20.2#820002-sha1:829506d) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.432495.1643201508000.25021.1646070480305%40Atlassian.JIRA.