Product:

Puppet

(Puppet)
Repositories https://github.com/puppetlabs/puppet
#Vulnerabilities 43
Date Id Summary Products Score Patch Annotated
2012-05-29 CVE-2012-1988 Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request. Ubuntu_linux, Debian_linux, Fedora, Puppet, Puppet_enterprise N/A
2021-09-07 CVE-2021-27022 A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes). Puppet, Puppet_enterprise 4.9
2021-11-18 CVE-2021-27025 A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'. Fedora, Puppet, Puppet_agent, Puppet_enterprise 6.5
2023-10-03 CVE-2023-5255 For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. Puppet, Puppet_server 7.5
2013-03-20 CVE-2013-1640 The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request. Ubuntu_linux, Puppet, Puppet_enterprise N/A
2018-02-09 CVE-2017-10690 In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4 Puppet, Puppet_enterprise, Satellite 6.5
2018-06-11 CVE-2018-6513 Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. This was possible through the loading of shared libraries from untrusted paths. Puppet, Puppet_enterprise 8.8
2021-07-20 CVE-2021-27021 A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query. Puppet, Puppet_enterprise, Puppetdb 8.8
2021-11-18 CVE-2021-27026 A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged Puppet, Puppet_connect, Puppet_enterprise 4.4
2020-02-19 CVE-2020-7942 Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19... Puppet, Puppet_agent 6.5