VulnerableCode Package Details - pkg:deb/debian/puppet@3.7.0-1?distro=bullseye

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-7ypq-wmb7-quhc	Moderate severity vulnerability that affects facter, hiera, mcollective-client, and puppet Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.	CVE-2014-3248 GHSA-92v7-pq4h-58j5
VCID-kkve-dj7r-gue1	puppet: certificates could be honored even when revoked	CVE-2014-3250

Vulnerability

Summary

Aliases

VCID-7ypq-wmb7-quhc

Moderate severity vulnerability that affects facter, hiera, mcollective-client, and puppet Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

CVE-2014-3248
GHSA-92v7-pq4h-58j5

VCID-kkve-dj7r-gue1

puppet: certificates could be honored even when revoked

CVE-2014-3250

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T12:58:12.507815+00:00	Debian Importer	Fixing	VCID-kkve-dj7r-gue1	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-16T12:15:37.980067+00:00	Debian Importer	Fixing	VCID-7ypq-wmb7-quhc	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-13T08:54:34.787326+00:00	Debian Importer	Fixing	VCID-kkve-dj7r-gue1	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-13T08:23:07.587948+00:00	Debian Importer	Fixing	VCID-7ypq-wmb7-quhc	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-03T07:50:26.313813+00:00	Debian Importer	Fixing	VCID-kkve-dj7r-gue1	https://security-tracker.debian.org/tracker/data/json	38.1.0
2026-04-03T07:50:26.272576+00:00	Debian Importer	Fixing	VCID-7ypq-wmb7-quhc	https://security-tracker.debian.org/tracker/data/json	38.1.0