PU
Vendor
Puppetlabs
39
CVEs
0
On KEV
0
New 30D
Products
PU–
Puppet
Puppetlabs
29 CVEs0 on KEV0 new
PE–
Puppet Enterprise Users
Puppetlabs
5 CVEs0 on KEV0 new
FA–
Facter
Puppetlabs
2 CVEs0 on KEV0 new
MC–
Mcollective
Puppetlabs
1 CVEs0 on KEV0 new
MC6.6
Mcollective-puppet-agent
Puppetlabs
1 CVEs0 on KEV0 new
PE5.3
Puppet Enterprise
Puppetlabs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2016-2787 | PE Puppet Enterprise Puppetlabs | 5.3 | Feb 13 | The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted… |
| CVE-2015-7331 | MC Mcollective-puppet-agent Puppetlabs | 6.6 | Jan 30 | The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument |
| CVE-2015-1426 | FA Facter Puppetlabs | – | Feb 23 | Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node |
| CVE-2014-3248 | FA Facter Puppetlabs | – | Nov 16 | Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and… |
| CVE-2014-3251 | MC Mcollective Puppetlabs | – | Aug 12 | The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA… |
| CVE-2013-1399 | PU Puppet Puppetlabs | – | Mar 14 | Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet… |
| CVE-2013-1398 | PU Puppet Puppetlabs | – | Mar 14 | The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to… |
| CVE-2012-5158 | PU Puppet Puppetlabs | – | Mar 14 | Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via… |
| CVE-2013-4969 | PU Puppet Puppetlabs | – | Jan 7 | Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on… |
| CVE-2013-4956 | PU Puppet Puppetlabs | – | Aug 20 | Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak… |
| CVE-2013-4761 | PU Puppet Puppetlabs | – | Aug 20 | Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute… |
| CVE-2013-3567 | PU Puppet Puppetlabs | – | Aug 19 | Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby… |
| CVE-2013-2716 | PU Puppet Puppetlabs | – | Apr 10 | Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x… |
| CVE-2013-2275 | PU Puppet Puppetlabs | – | Mar 20 | The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x… |
| CVE-2013-2274 | PU Puppet Puppetlabs | – | Mar 20 | Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick… |
| CVE-2013-1655 | PU Puppet Puppetlabs | – | Mar 20 | Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized… |
| CVE-2013-1654 | PU Puppet Puppetlabs | – | Mar 20 | Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows… |
| CVE-2013-1653 | PU Puppet Puppetlabs | – | Mar 20 | Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled… |
| CVE-2013-1652 | PU Puppet Puppetlabs | – | Mar 20 | Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid… |
| CVE-2012-3867 | PU Puppet Puppetlabs | – | Aug 6 | lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the… |
| CVE-2012-3866 | PU Puppet Puppetlabs | – | Aug 6 | lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain… |
| CVE-2012-3865 | PU Puppet Puppetlabs | – | Aug 6 | Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in… |
| CVE-2012-3864 | PU Puppet Puppetlabs | – | Aug 6 | Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by… |
| CVE-2012-3408 | PU Puppet Puppetlabs | – | Aug 6 | lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which… |
| CVE-2012-1989 | PU Puppet Puppetlabs | – | Jun 27 | telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the… |
| CVE-2012-1986 | PE Puppet Enterprise Users Puppetlabs | – | May 29 | Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an… |
| CVE-2012-1906 | PU Puppet Puppetlabs | – | May 29 | Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac… |
| CVE-2012-1054 | PU Puppet Puppetlabs | – | May 29 | Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource… |
| CVE-2012-1053 | PU Puppet Puppetlabs | – | May 29 | The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x,… |
| CVE-2011-3872 | PE Puppet Enterprise Users Puppetlabs | – | Oct 27 | Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's… |
| CVE-2011-3871 | PU Puppet Puppetlabs | – | Oct 27 | Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or… |
| CVE-2011-3870 | PU Puppet Puppetlabs | – | Oct 27 | Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file |
| CVE-2011-3869 | PU Puppet Puppetlabs | – | Oct 27 | Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file |
| CVE-2011-3848 | PU Puppet Puppetlabs | – | Oct 27 | Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary… |