puppet

Advisories 23

• CVE-2021-27023Unrated

  A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a…

  Affected: from 7.0.0, fixed in 7.12.1; fixed in 6.25.1.

• CVE-2021-27025Unrated

  A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service…

  Affected: from 7.0.0, fixed in 7.12.1; fixed in 6.25.1.

• CVE-2020-7942Unrated

  Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a…

  Affected: from 6.0.0, fixed in 6.13.0; fixed in 5.5.19.

• CVE-2017-10689Unrated

  In previous versions of Puppet Agent it was possible to install a module with world writable permissions.

  Affected: fixed in 4.10.10; from 5.0.0, fixed in 5.3.4.

• CVE-2016-2785Unrated

  Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers…

  Affected: from 4.0.0, fixed in 4.4.2.

• CVE-2014-3248Unrated

  Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x…

  Affected: fixed in 2.7.26; from 3.0.0, fixed in 3.6.2.

• CVE-2011-0528Unrated

  Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or…

  Affected: from 2.6.0, fixed in 2.6.4.

• CVE-2013-4761Unrated

  Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before…

  Affected: from 2.7.0, fixed in 2.7.23; from 3.2.0, fixed in 3.2.4.

• CVE-2013-3567Unrated

  Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote…

  Affected: from 2.7.0, fixed in 2.7.22; from 3.2.0, fixed in 3.2.2.

• CVE-2013-1655Unrated

  Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via…

  Affected: from 2.7.0, fixed in 2.7.21; from 3.1.0, fixed in 3.1.1.

• CVE-2012-3867Unrated

  lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not…

  Affected: fixed in 2.6.17; from 2.7.0, fixed in 2.7.18.

• CVE-2012-3866Unrated

  lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml…

  Affected: from 2.7.0, fixed in 2.7.18.

• CVE-2012-3865Unrated

  Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise…

  Affected: fixed in 2.6.17; from 2.7.0, fixed in 2.7.18.

• CVE-2012-3408Unrated

  lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames…

  Affected: fixed in 2.7.18.

• CVE-2012-1989Unrated

  telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite…

  Affected: from 2.7.1, fixed in 2.7.13.