Low severityNVD Advisory· Published Feb 23, 2015· Updated May 6, 2026
CVE-2015-1426
CVE-2015-1426
Description
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
facterRubyGems | >= 1.6.0, < 2.4.1 | 2.4.1 |
Affected products
70cpe:2.3:a:puppet:facter:1.6.0:*:*:*:*:*:*:*+ 44 more
- cpe:2.3:a:puppet:facter:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.10:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.11:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.12:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.12:rc2:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.13:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.14:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.15:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.16:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.17:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.18:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.1:rc3:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.1:rc4:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.6:rc2:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.7:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.8:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.6.9:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.7.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.7.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.7.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.7.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.7.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.7.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.7.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:1.7.5:rc2:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.0.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.0.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.0.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.0.1:rc3:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.0.1:rc4:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:facter:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:puppetlabs:facter:1.6.1:*:*:*:*:*:*:*+ 24 more
- cpe:2.3:a:puppetlabs:facter:1.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.12:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.13:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.14:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.15:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.17:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.18:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:1.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:facter:2.0.1:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- puppetlabs.com/security/cve/cve-2015-1426nvdVendor Advisory
- github.com/advisories/GHSA-j436-h7hm-rx46ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2015-1426ghsaADVISORY
- github.com/rubysec/ruby-advisory-db/blob/master/gems/facter/CVE-2015-1426.ymlghsaWEB
- web.archive.org/web/20150906195742/http://puppetlabs.com/security/cve/cve-2015-1426ghsaWEB
- www.puppet.com/security/cve/cve-2015-1426-potential-sensitive-information-leakage-facters-amazon-ec2-metadataghsaWEB
News mentions
0No linked articles in our index yet.