Search for packages
| purl | pkg:gem/puppet@6.8.1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5qhd-8wfe-27dy
Aliases: CVE-2011-0528 GHSA-9pvx-fwwh-w289 |
Puppet does not properly restrict access to node resources Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors. | There are no reported fixed by versions. |
|
VCID-63rx-372a-ukby
Aliases: CVE-2020-7942 GHSA-gqvf-892r-vjm5 |
Improper Certificate Validation in Puppet Previously, Puppet operated on the model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. |
Affected by 8 other vulnerabilities. |
|
VCID-8xgm-pabz-hkeg
Aliases: CVE-2017-10689 GHSA-vw22-465p-8j5w |
Improper Privilege Management In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability. | There are no reported fixed by versions. |
|
VCID-h88b-abes-3bgr
Aliases: CVE-2012-1987 GHSA-v58w-6xc2-w799 |
Puppet Denial of Service and Arbitrary File Write Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations. | There are no reported fixed by versions. |
|
VCID-jhkk-5euf-uked
Aliases: CVE-2011-3869 GHSA-8c56-v25w-f89c |
Improper Link Resolution Before File Access ('Link Following') Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file. | There are no reported fixed by versions. |
|
VCID-kt2h-k72f-tqc7
Aliases: CVE-2012-1988 GHSA-6xxq-j39w-g3f6 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request. | There are no reported fixed by versions. |
|
VCID-qdsk-m9ye-z3a4
Aliases: CVE-2021-27023 GHSA-93j5-g845-9wqp |
Unsafe HTTP Redirect in Puppet Agent and Puppet Server A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007 |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-s94z-5sd6-33dk
Aliases: CVE-2021-27025 GHSA-q4g7-jrxv-67r9 |
Silent Configuration Failure in Puppet Agent A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'. |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-ww8x-tzxr-4qbn
Aliases: CVE-2010-0156 GHSA-vrh7-99jh-3fmm |
Improper Link Resolution Before File Access ('Link Following') Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||