VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 12, 2014· Updated Jun 17, 2026

CVE-2014-3251

CVE-2014-3251

Description

The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.

Affected products

4
  • Puppet (software)/Mcollective2 versions
    cpe:2.3:a:puppetlabs:mcollective:-:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:puppetlabs:mcollective:-:*:*:*:*:*:*:*
    • (no CPE)range: < 2.5.3
  • Puppet (software)/Puppet Enterprise2 versions
    cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*range: <=3.2.0
    • (no CPE)range: < 3.3.0

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.