puppet

Vulnerabilities (23)

• CVE-2021-27023Nov 18, 2021
  affected >= 7.0.0, < 7.12.1fixed 7.12.1

  A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

• CVE-2021-27025Nov 18, 2021
  affected >= 7.0.0, < 7.12.1fixed 7.12.1

  A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

• CVE-2020-7942Feb 19, 2020
  affected >= 6.0.0, < 6.13.0fixed 6.13.0

  Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can

• CVE-2017-10689Feb 9, 2018
  affected < 4.10.10fixed 4.10.10

  In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

• CVE-2016-2785CriJun 10, 2016
  affected >= 4.0.0, < 4.4.2fixed 4.4.2

  Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

• CVE-2014-3248Nov 16, 2014
  affected < 2.7.26fixed 2.7.26

  Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privilege

• CVE-2011-0528Feb 17, 2014
  affected >= 2.6.0, < 2.6.4fixed 2.6.4

  Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.

• CVE-2013-4761Aug 20, 2013
  affected >= 2.7.0, < 2.7.23fixed 2.7.23

  Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can

• CVE-2013-3567Aug 19, 2013
  affected >= 2.7.0, < 2.7.22fixed 2.7.22

  Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

• CVE-2013-1655Mar 20, 2013
  affected >= 2.7.0, < 2.7.21fixed 2.7.21

  Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."

• CVE-2012-3867Aug 6, 2012
  affected < 2.6.17fixed 2.6.17

  lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote a

• CVE-2012-3866Aug 6, 2012
  affected >= 2.7.0, < 2.7.18fixed 2.7.18

  lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.

• CVE-2012-3865Aug 6, 2012
  affected < 2.6.17fixed 2.6.17

  Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a

• CVE-2012-3408Aug 6, 2012
  affected < 2.7.18fixed 2.7.18

  lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.

• CVE-2012-1989Jun 27, 2012
  affected >= 2.7.1, < 2.7.13fixed 2.7.13

  telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).

• CVE-2012-1988May 29, 2012
  affected >= 2.6.0, < 2.6.15fixed 2.6.15

  Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a

• CVE-2012-1906May 29, 2012
  affected >= 2.6, < 2.6.15fixed 2.6.15

  Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install

• CVE-2012-1053May 29, 2012
  affected >= 2.6, < 2.6.14fixed 2.6.14

  The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privi

• CVE-2012-1987May 29, 2012
  affected >= 2.6.0, < 2.6.15fixed 2.6.15

  Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST

• CVE-2011-3871Oct 27, 2011
  affected >= 2.7.0, < 2.7.5fixed 2.7.5

  Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.