CVE-2017-10690: In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from

Medium severity · published Feb 9, 2018

CVE-2017-10690

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from

6.5

CVSS

EPSS

On KEV

Description

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 63% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Puppet · Puppet

before 5.3.4 · source: NVD

Puppet Enterprise · Puppet

before 2017.3.4 · source: NVD

Satellite · Redhat

6.4 · source: NVD

Affected product

Puppet

All Puppet CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2017-10690

CVE.org

https://www.cve.org/CVERecord?id=CVE-2017-10690

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2927

Vendor Advisory

https://puppet.com/security/cve/CVE-2017-10690