# puppet (RubyGems) vulnerabilities 23 known vulnerabilities, with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://rubygems.org/gems/puppet ## Advisories (23) ### [CVE-2021-27023](https://cve.now/CVE-2021-27023): A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a… - Severity: Unrated - Published: Nov 18, 2021 - Affected: from 7.0.0, fixed in 7.12.1; fixed in 6.25.1. ### [CVE-2021-27025](https://cve.now/CVE-2021-27025): A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service… - Severity: Unrated - Published: Nov 18, 2021 - Affected: from 7.0.0, fixed in 7.12.1; fixed in 6.25.1. ### [CVE-2020-7942](https://cve.now/CVE-2020-7942): Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a… - Severity: Unrated - Published: Feb 19, 2020 - Affected: from 6.0.0, fixed in 6.13.0; fixed in 5.5.19. ### [CVE-2017-10689](https://cve.now/CVE-2017-10689): In previous versions of Puppet Agent it was possible to install a module with world writable permissions. - Severity: Unrated - Published: Feb 9, 2018 - Affected: fixed in 4.10.10; from 5.0.0, fixed in 5.3.4. ### [CVE-2016-2785](https://cve.now/CVE-2016-2785): Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers… - Severity: Unrated - Published: Jun 10, 2016 - Affected: from 4.0.0, fixed in 4.4.2. ### [CVE-2014-3248](https://cve.now/CVE-2014-3248): Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x… - Severity: Unrated - Published: Nov 16, 2014 - Affected: fixed in 2.7.26; from 3.0.0, fixed in 3.6.2. ### [CVE-2011-0528](https://cve.now/CVE-2011-0528): Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or… - Severity: Unrated - Published: Feb 17, 2014 - Affected: from 2.6.0, fixed in 2.6.4. ### [CVE-2013-4761](https://cve.now/CVE-2013-4761): Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before… - Severity: Unrated - Published: Aug 20, 2013 - Affected: from 2.7.0, fixed in 2.7.23; from 3.2.0, fixed in 3.2.4. ### [CVE-2013-3567](https://cve.now/CVE-2013-3567): Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote… - Severity: Unrated - Published: Aug 19, 2013 - Affected: from 2.7.0, fixed in 2.7.22; from 3.2.0, fixed in 3.2.2. ### [CVE-2013-1655](https://cve.now/CVE-2013-1655): Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via… - Severity: Unrated - Published: Mar 20, 2013 - Affected: from 2.7.0, fixed in 2.7.21; from 3.1.0, fixed in 3.1.1. ### [CVE-2012-3867](https://cve.now/CVE-2012-3867): lib/puppet/ssl/certificate\_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not… - Severity: Unrated - Published: Aug 6, 2012 - Affected: fixed in 2.6.17; from 2.7.0, fixed in 2.7.18. ### [CVE-2012-3866](https://cve.now/CVE-2012-3866): lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last\_run\_report.yaml… - Severity: Unrated - Published: Aug 6, 2012 - Affected: from 2.7.0, fixed in 2.7.18. ### [CVE-2012-3865](https://cve.now/CVE-2012-3865): Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise… - Severity: Unrated - Published: Aug 6, 2012 - Affected: fixed in 2.6.17; from 2.7.0, fixed in 2.7.18. ### [CVE-2012-3408](https://cve.now/CVE-2012-3408): lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames… - Severity: Unrated - Published: Aug 6, 2012 - Affected: fixed in 2.7.18. ### [CVE-2012-1989](https://cve.now/CVE-2012-1989): telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite… - Severity: Unrated - Published: Jun 27, 2012 - Affected: from 2.7.1, fixed in 2.7.13. ### [CVE-2012-1988](https://cve.now/CVE-2012-1988): Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows… - Severity: Unrated - Published: May 29, 2012 - Affected: from 2.6.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.13. ### [CVE-2012-1987](https://cve.now/CVE-2012-1987): Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x… - Severity: Unrated - Published: May 29, 2012 - Affected: from 2.6.0, fixed in 2.6.15; from 2.7.0, fixed in 2.7.13. ### [CVE-2012-1906](https://cve.now/CVE-2012-1906): Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses… - Severity: Unrated - Published: May 29, 2012 - Affected: from 2.6, fixed in 2.6.15; from 2.7, fixed in 2.7.13. ### [CVE-2012-1053](https://cve.now/CVE-2012-1053): The change\_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and… - Severity: Unrated - Published: May 29, 2012 - Affected: from 2.6, fixed in 2.6.14; from 2.7, fixed in 2.7.11. ### [CVE-2011-3871](https://cve.now/CVE-2011-3871): Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local… - Severity: Unrated - Published: Oct 27, 2011 - Affected: from 2.7.0, fixed in 2.7.5; fixed in 2.6.11. ### [CVE-2011-3870](https://cve.now/CVE-2011-3870): Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink… - Severity: Unrated - Published: Oct 27, 2011 - Affected: from 2.7.0, fixed in 2.7.5; fixed in 2.6.11. ### [CVE-2011-3869](https://cve.now/CVE-2011-3869): Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the… - Severity: Unrated - Published: Oct 27, 2011 - Affected: from 2.7.0, fixed in 2.7.5; fixed in 2.6.11. ### [CVE-2010-0156](https://cve.now/CVE-2010-0156): Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1)… - Severity: Unrated - Published: Mar 3, 2010 - Affected: from 0.24.0, fixed in 0.24.9; from 0.25.0, fixed in 0.25.2. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/rubygems/puppet Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.