Critical severity · published Oct 7, 2022
CVE-2022-3275
Puppetlabs-apt Command Injection
9.8
CVSS
2.4%
EPSS
No
On KEV
Description
Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
puppetlabs-apt · Puppet
before 9.0.0 · source: vendor
FE
Fedora · Fedoraproject
36; 37 · source: NVD
PU
Puppetlabs-mysql · Puppet
before 9.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3275
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3275
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CH4NUKZKPY4MFQHFBTONJK2AWES4DFDA/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR5LIOF5VKS4DC2NQWXTMPPXOYJC46XC/
Vendor Advisory
https://puppet.com/security/cve/CVE-2022-3275