2017/10/GHSA-8jxj-9r5f-w3m2 Puppet allows local users to obtain sensitive configuration information