CVE-2013-1652
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1...
CVE-2013-1652 is a medium vulnerability (CVSS 4.9) in Puppet, published March 12, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. Fixed in puppet 2.7.18-3.
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
- Record
CVE-2013-1652- CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
- Record
CVE-2013-1652- Updated
- 2026-11-02
EUVDEUVD-2013-1683 No score
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
- Record
EUVD-2013-1683- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3rpq-2xpx-53c4 No score
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1...
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
- Record
GHSA-3rpq-2xpx-53c4- Updated
- 2026-11-02
OSV No score
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
- Record
CVE-2013-1652- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1652 No score
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
- Record
DEBIAN-CVE-2013-1652- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetDebian:11 |
before 2.7.18-3 | 2.7.18-3 |
puppetDebian:6.0 |
before 2.6.2-5+squeeze7, plus listed versions 2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze42.6.2-5+squeeze52.6.2-5+squeeze6 |
2.6.2-5+squeeze7 |
puppetRed Hat:openstack:2::el6 |
before 0:2.6.18-1.el6ost | 0:2.6.18-1.el6ost |
puppet-serverRed Hat:openstack:2::el6 |
before 0:2.6.18-1.el6ost | 0:2.6.18-1.el6ost |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
rhn.redhat.com/errata/RHSA-2013-0710.html
debian.org/security/2013/dsa-2643
securityfocus.com/bid/58443
secunia.com/advisories/52596
ubuntu.com/usn/usn-1759-1
Show 32 moreShow less
puppetlabs.com/security/cve/cve-2013-1652
nvd.nist.gov/vuln/detail/CVE-2013-1652
github.com/advisories/GHSA-3rpq-2xpx-53c4
security-tracker.debian.org/tracker/CVE-2013-1652
access.redhat.com/errata/RHSA-2013:0710
bugzilla.redhat.com/show_bug.cgi?id=908629
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0710.json
cve.org/CVERecord?id=CVE-2012-6120