Search for packages
| purl | pkg:deb/debian/puppet@5.5.22-2?distro=bullseye |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-18aq-72zg-3uc9 | puppet: Unsafe YAML deserialization |
CVE-2017-2295
|
| VCID-1dbs-z8sn-e3fv | Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors. |
CVE-2015-7328
|
| VCID-2jc8-n1j4-m7c6 | Puppet Privilege Escallation The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups. |
CVE-2012-1053
GHSA-77hg-g8cc-5r37 |
| VCID-37yk-3v22-4qg7 | The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise: 2018.1.x versions prior to 2018.1.1 and razor-server and pe-razor-server prior to 1.9.0.0. |
CVE-2018-6512
|
| VCID-3jdp-jh74-37c6 | Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges by leveraging an unattended workstation. |
CVE-2013-4958
|
| VCID-3kma-3ffw-8qd9 | Improper Input Validation Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call. |
CVE-2013-3567
GHSA-f7p5-w2cr-7cp7 |
| VCID-3zzj-krc5-skea | Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. |
CVE-2013-2275
|
| VCID-4tw7-zg73-q3cd | A privilege escalation allowing remote code execution was discovered in the orchestration service. |
CVE-2023-2530
|
| VCID-56xc-5fxu-kka3 | Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack sessions by obtaining an old session ID. |
CVE-2013-4762
|
| VCID-5g6u-uvej-xbad | Moderate severity vulnerability that affects puppet Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master. |
CVE-2013-4761
GHSA-cj43-9h3w-v976 |
| VCID-5qhd-8wfe-27dy | Puppet does not properly restrict access to node resources Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors. |
CVE-2011-0528
GHSA-9pvx-fwwh-w289 |
| VCID-5uhz-zcuf-4uej | The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console. |
CVE-2013-4966
|
| VCID-6vjt-rsq7-ekc9 | Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. |
CVE-2013-1399
|
| VCID-729g-ky6n-1yfg | The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role. |
CVE-2013-1398
|
| VCID-72s2-y7m6-kuf6 | Multiple vulnerabilities have been found in Puppet, the worst of which might allow local attackers to gain escalated privileges. |
CVE-2012-1054
|
| VCID-73uh-2gkm-6kgy | Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. |
CVE-2013-4956
|
| VCID-75gs-2gu3-6udx | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name. |
CVE-2012-3865
GHSA-g89m-3wjw-h857 |
| VCID-7jtp-a1nw-bqfs | Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. |
CVE-2013-1640
|
| VCID-7kzg-339v-vqbs | Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors. |
CVE-2012-5158
|
| VCID-7ypq-wmb7-quhc | Moderate severity vulnerability that affects facter, hiera, mcollective-client, and puppet Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine. |
CVE-2014-3248
GHSA-92v7-pq4h-58j5 |
| VCID-82mm-jjnu-sbfa | In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2. |
CVE-2017-2296
|
| VCID-84e7-2rxq-b7e1 | A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes). |
CVE-2021-27022
|
| VCID-8xgm-pabz-hkeg | Improper Privilege Management In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability. |
CVE-2017-10689
GHSA-vw22-465p-8j5w |
| VCID-92u1-6e9d-tqga | Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a (1) report, (2) group, or (3) class or possibly have other unspecified impact. |
CVE-2013-4963
|
| VCID-a1p5-fyr1-wuaq | Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the lack of access control for /nodes. |
CVE-2013-4967
|
| VCID-a7cn-eqbq-qyb1 | Puppet uses predictable filenames, allowing arbitrary file overwrite Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files. |
CVE-2011-3871
GHSA-mpmx-gm5v-q789 |
| VCID-absc-ndrs-yqep | Multiple vulnerabilities have been found in Puppet, the worst of which might allow local attackers to gain escalated privileges. |
CVE-2009-3564
|
| VCID-b94j-dcjk-eqeu | Improper Authentication lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address. |
CVE-2012-3408
GHSA-vxf6-w9mp-95hm |
| VCID-bccx-uph7-67cj | A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Orchestrator. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6. |
CVE-2018-6510
|
| VCID-bjts-v9q2-9yg8 | several |
CVE-2013-4073
GHSA-3gpq-xx45-4rr9 OSV-94628 |
| VCID-bqtz-8vkk-xbg6 | puppet: Puppet Server ReDoS |
CVE-2023-1894
|
| VCID-bsa9-fu5y-p7at | A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Puppet Enterprise Console. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6. |
CVE-2018-6511
|
| VCID-bt3p-h1js-53gg | Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0. |
CVE-2016-5713
|
| VCID-bu53-ez2r-vfcr | Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, which allows remote attackers to obtain sensitive information. |
CVE-2013-4961
|
| VCID-d6vw-w8g1-q7fk | Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted by the master, aka a "Certificate Authority Reverse Proxy Vulnerability." |
CVE-2015-4100
|
| VCID-dnjn-tqgb-g7fs | Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. |
CVE-2013-4964
|
| VCID-eggd-sxe6-dbh3 | Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501. |
CVE-2016-5715
|
| VCID-ekj3-h7sp-33fg | Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force attack. |
CVE-2013-4965
|
| VCID-eqmw-4ast-tqc3 | Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors. |
CVE-2013-4971
|
| VCID-fdk4-8wtn-nqct | Multiple vulnerabilities have been found in Puppet, the worst of which might allow local attackers to gain escalated privileges. |
CVE-2011-3848
|
| VCID-fjbx-bqnn-2bf3 | insecure temporary files |
CVE-2013-4969
|
| VCID-h88b-abes-3bgr | Puppet Denial of Service and Arbitrary File Write Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations. |
CVE-2012-1987
GHSA-v58w-6xc2-w799 |
| VCID-he38-9hxb-9ycb | Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5 and 2017.2.1. This only affects users with labeled tokens, which is not the default for tokens. |
CVE-2017-2297
|
| VCID-hexs-rr6c-pqap | puppet-agent: Deserialization of untrusted data |
CVE-2021-27017
|
| VCID-jhkk-5euf-uked | Improper Link Resolution Before File Access ('Link Following') Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file. |
CVE-2011-3869
GHSA-8c56-v25w-f89c |
| VCID-kkve-dj7r-gue1 | puppet: certificates could be honored even when revoked |
CVE-2014-3250
|
| VCID-kt2h-k72f-tqc7 | Improper Neutralization of Special Elements used in a Command ('Command Injection') Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request. |
CVE-2012-1988
GHSA-6xxq-j39w-g3f6 |
| VCID-muyn-v1ah-27br | When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS score. |
CVE-2018-11749
|
| VCID-mv4z-k16a-hfgr | Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint. |
CVE-2014-9355
|
| VCID-mz9n-ttkc-bfhx | The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2. |
CVE-2016-9686
|
| VCID-n8dt-ef15-wfgv | puppet-agent: pxp-agent attempts to configure OpenSSL from uncontrolled location |
CVE-2018-6515
|
| VCID-nf2h-5vd2-6kb1 | Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. |
CVE-2013-1653
|
| VCID-p3cs-jvy5-pyda | Multiple vulnerabilities have been found in Puppet Server and Agent, the worst of which could lead to arbitrary code execution. |
CVE-2016-2786
|
| VCID-pdpa-qfpq-zkcq | Improper Input Validation Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes." |
CVE-2013-1655
GHSA-574q-fxfj-wv6h |
| VCID-pgg8-9sk2-57ee | Low severity vulnerability that affects puppet telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log). |
CVE-2012-1989
GHSA-c5qq-g673-5p49 |
| VCID-pj4s-vjbb-u7h7 | Improper Access Control Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding. |
CVE-2016-2785
GHSA-pqj5-7r86-64fv |
| VCID-prfa-kwxa-hya6 | puppet: Denial of Service for Revocation of Auto Renewed Certificates |
CVE-2023-5255
|
| VCID-qs9z-st4f-gkcq | Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes. |
CVE-2014-3249
|
| VCID-rfcx-7kc9-mbcr | Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. |
CVE-2013-2274
|
| VCID-rqbn-6eng-tyhs | Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. This was possible through the loading of shared libraries from untrusted paths. |
CVE-2018-6513
|
| VCID-rrky-upea-nfd4 | puppet: authenticated clients allowed to read arbitrary files from the puppet master |
CVE-2012-3864
|
| VCID-rt19-c3m9-yyfx | Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct cross-site scripting (XSS) attacks via unspecified vectors related to "live management." |
CVE-2013-4968
|
| VCID-s3wm-tmvz-tbhj | Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. |
CVE-2021-27020
|
| VCID-s8jz-vr9t-87dy | The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors. |
CVE-2016-2787
|
| VCID-sd5c-wx86-t3c1 | Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow local users to obtain sensitive information such as (1) host name, (2) MAC address, and (3) SSH keys via the web browser cache. |
CVE-2013-4959
|
| VCID-sqqa-bcxy-9uht | Open redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the service parameter. |
CVE-2013-4955
|
| VCID-sweb-hbec-k3ha | Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. |
CVE-2013-1652
|
| VCID-tetf-xa1u-uffv | Puppet uses predictable filenames, allowing arbitrary file overwrite Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp. |
CVE-2012-1906
GHSA-c4mc-49hq-q275 |
| VCID-txcc-y6jy-q7a6 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this functionality can change this policy. |
CVE-2017-2293
|
| VCID-txx3-3fzg-33cp | Improper Link Resolution Before File Access ('Link Following') Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file. |
CVE-2011-3870
GHSA-qh3g-27jf-3j54 |
| VCID-u5hk-xgp2-4qea | On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation. |
CVE-2018-6516
|
| VCID-u983-ve5j-gkgr | The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument. |
CVE-2015-7331
|
| VCID-ugqt-zyga-1ydy | puppet: puppet server and puppetDB may leak sensitive information via metrics API |
CVE-2020-7943
|
| VCID-v1kq-tkfx-bycx | The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors. |
CVE-2013-4962
|
| VCID-v61q-45uv-uuf7 | puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL |
CVE-2018-11751
|
| VCID-v9kt-4vxm-ekdw | Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. |
CVE-2012-6120
|
| VCID-vgbw-4yuu-57fz | Low severity vulnerability that affects puppet lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file. |
CVE-2012-3866
GHSA-8jxj-9r5f-w3m2 |
| VCID-vrzs-81t1-jyax | Multiple vulnerabilities have been found in Puppet, the worst of which might allow local attackers to gain escalated privileges. |
CVE-2011-3872
|
| VCID-vyk2-e5pa-bff3 | Open redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the string parameter. |
CVE-2015-6501
|
| VCID-wage-71h9-6qay | Moderate severity vulnerability that affects puppet lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences. |
CVE-2012-3867
GHSA-q44r-f2hm-v76v |
| VCID-wdwr-8m6q-kff5 | Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. |
CVE-2013-1654
|
| VCID-wkb1-dm1m-67db | Multiple vulnerabilities have been found in Puppet Agent, the worst of which could result in the execution of arbitrary code. |
CVE-2016-5714
|
| VCID-wnjy-ggeb-eqcn | puppet: Environment leakage in puppet-agent |
CVE-2017-10690
|
| VCID-ww8x-tzxr-4qbn | Improper Link Resolution Before File Access ('Link Following') Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file. |
CVE-2010-0156
GHSA-vrh7-99jh-3fmm |
| VCID-xqap-n8rp-g7fn | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore. |
CVE-2017-2294
|
| VCID-y3ft-rkcs-7kg2 | The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node. |
CVE-2016-5716
|
| VCID-yycs-ny3v-pyeh | Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. |
CVE-2012-1986
|