PU
Product
Puppet
42
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 7Low 0
Watch
Add Puppet to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-2785 | 9.8 | Jun 10 | Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access… Affected: 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.1.0; 4.2.0; +8 more |
| CVE-2021-27021 | 8.8 | Jul 20 | A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query Affected: before 6.23.0; 7.7.0 before 7.8.0 |
| CVE-2018-6513 | 8.8 | Jun 11 | Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13,… Affected: 1.10.0 before 1.10.13; 5.3.0 before 5.3.7; 5.5.0 before 5.5.2 |
| CVE-2017-2295 | 8.2 | Jul 5 | Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format Affected: through 4.10.0 |
| CVE-2018-6515 | 7.8 | Jun 11 | Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an… Affected: 1.10.0 before 1.10.13; 5.3.0 before 5.3.7; 5.5.0 before 5.5.2 |
| CVE-2018-6514 | 7.8 | Jun 11 | In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which… Affected: 1.10.0 before 1.10.13; 5.3.0 before 5.3.7; 5.5.0 before 5.5.2 |
| CVE-2021-27025 | 6.5 | Nov 18 | A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync' Affected: 2021.0.0 before 2021.4.0 |
| CVE-2020-7942 | 6.5 | Feb 19 | Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to… Affected: 5.5.0 before 5.5.19; 6.0.0 before 6.13.0 |
| CVE-2017-10690 | 6.5 | Feb 9 | In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from Affected: before 5.3.4 |
| CVE-2014-3250 | 6.5 | Dec 11 | The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information… Affected: before 3.6.2 |
| CVE-2017-10689 | 5.5 | Feb 9 | In previous versions of Puppet Agent it was possible to install a module with world writable permissions Affected: before 5.3.4; 1.10.0 before 1.10.10 |
| CVE-2021-27022 | 4.9 | Sep 7 | A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be Affected: 2021.0.0 before 2021.3.0 |
| CVE-2021-27026 | 4.4 | Nov 18 | A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged Affected: 2021.0.0 before 2021.4.0 |
| CVE-2014-3248 | – | Nov 16 | Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and… Affected: before 2.7.26; 3.6.0 before 3.6.2 |
| CVE-2011-0528 | – | Feb 17 | Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3 |
| CVE-2013-4956 | – | Aug 20 | Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak… Affected: 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6; 2.7.7; +15 more |
| CVE-2013-4761 | – | Aug 20 | Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute… Affected: 3.2.1; 3.2.2; 3.2.3; 2.7.2 |
| CVE-2013-3567 | – | Aug 19 | Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby… Affected: 2.7.2; 2.7.10; 2.7.11; 2.7.12; 2.7.13; 2.7.14; +5 more |
| CVE-2013-2275 | – | Mar 20 | The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +27 more |
| CVE-2013-2274 | – | Mar 20 | Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +11 more |
| CVE-2013-1655 | – | Mar 20 | Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized… Affected: 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6; 2.7.7; +10 more |
| CVE-2013-1654 | – | Mar 20 | Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows… Affected: 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6; 2.7.7; +10 more |
| CVE-2013-1653 | – | Mar 20 | Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled… Affected: 2.6.0 through 2.6.17; 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6; +11 more |
| CVE-2013-1652 | – | Mar 20 | Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid… Affected: 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6; 2.7.7; +10 more |
| CVE-2013-1640 | – | Mar 20 | The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7… Affected: before 2.6.18; 2.7.0 before 2.7.21; 3.1.0 |
| CVE-2012-3867 | – | Aug 6 | lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +25 more |
| CVE-2012-3866 | – | Aug 6 | lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain… Affected: 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6; 2.7.8; +7 more |
| CVE-2012-3865 | – | Aug 6 | Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in… Affected: 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6; 2.7.8; +23 more |
| CVE-2012-3864 | – | Aug 6 | Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +25 more |
| CVE-2012-1989 | – | Jun 27 | telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the… Affected: 2.7.3; 2.7.4; 2.7.5; 2.7.6; 2.7.8; 2.7.9; +3 more |
| CVE-2012-1988 | – | May 29 | Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent… Affected: 2.6.0 before 2.6.15; 2.7.0 before 2.7.13 |
| CVE-2012-1987 | – | May 29 | Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote… Affected: 2.6.0 before 2.6.15; 2.7.0 before 2.7.13 |
| CVE-2012-1986 | – | May 29 | Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +19 more |
| CVE-2012-1906 | – | May 29 | Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +19 more |
| CVE-2012-1054 | – | May 29 | Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +17 more |
| CVE-2012-1053 | – | May 29 | The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x,… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +17 more |
| CVE-2011-3872 | – | Oct 27 | Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +10 more |
| CVE-2011-3871 | – | Oct 27 | Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +15 more |
| CVE-2011-3870 | – | Oct 27 | Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +15 more |
| CVE-2011-3869 | – | Oct 27 | Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +15 more |
| CVE-2011-3848 | – | Oct 27 | Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +6 more |
| CVE-2010-0156 | – | Mar 3 | Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3)… Affected: 0.24.3; 0.24.4; 0.24.5; 0.24.6; 0.24.6; 0.24.6; +14 more |
Showing 42