Puppet vulnerabilities
37 CVEs and advisories name Puppet as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-9160Security Misconfiguration in Forge module PEADM
- CVE-2023-5309Broken Session Management in Puppet Enterprise
- CVE-2023-5214CVE-2023-5214 - Privilege Escalation in Puppet Bolt
- CVE-2023-5255Denial of Service for Revocation of Auto Renewed Certificates
- CVE-2023-2530A privilege escalation allowing remote code execution was discovered in the orchestration service.
- CVE-2023-1894A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation.
- CVE-2022-3276Puppetlabs-mysql Command Injection
- CVE-2022-3275Puppetlabs-apt Command Injection
- CVE-2022-2394Sensitive Parameter Exposure in Puppet Bolt prior to 3.24
- CVE-2022-0675Puppet Firewall Module May Leave Unmanaged Rules
- CVE-2020-7942Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a comprom
- CVE-2018-11747Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container.
- CVE-2018-6517Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's kno
- CVE-2018-11749When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server.
- CVE-2018-11746Puppet Discovery can leak authentication information
- CVE-2018-6516On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x pr
- CVE-2018-6515Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a speci
- CVE-2018-6514In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerab
- CVE-2018-6513Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, P
- CVE-2018-6512The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server.
- CVE-2018-6511XSS Vulnerability in Puppet Enterprise Console
- CVE-2018-6510XSS Vulnerability in Puppet Enterprise Console
- CVE-2018-6508Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the fa
- CVE-2017-10690In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retri
- CVE-2017-10689In previous versions of Puppet Agent it was possible to install a module with world writable permissions.
- CVE-2017-2297Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens.
- CVE-2017-2296In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group na
- CVE-2017-2293Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to ins
- CVE-2016-5713Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables th
- CVE-2017-2299Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust.