CVE-2014-3251
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective...
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
Exploit likelihood
What each source reports
NVD Score used
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
- Record
CVE-2014-3251- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
- Record
CVE-2014-3251- Updated
- 2026-11-02
EUVDEUVD-2014-3264 No score
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
- Record
EUVD-2014-3264- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q495-m6p3-c645 No score
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective...
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
- Record
GHSA-q495-m6p3-c645- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV No score
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
- Record
CVE-2014-3251- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3251 No score
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
- Record
DEBIAN-CVE-2014-3251- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mcollectiveDebian:12 |
before 2.6.0+dfsg-1 | 2.6.0+dfsg-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3251 is a medium vulnerability (CVSS 4.4) in Puppet Enterprise, published August 12, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in mcollective 2.6.0+dfsg-1.