{"id":"CVE-2013-2275","aliases":["DEBIAN-CVE-2013-2275","DSA-2643-1","EUVD-2013-2221","GHSA-wwmg-4q3j-qc4f","RHSA-2013:0710"],"status":"published","title":"The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x...","description":"The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02908,"percentile":0.87075,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-03-12T00:00:00Z","modified":"2026-08-04T06:03:45Z","fixes":[{"ecosystem":"Debian:11","package":"puppet","fixed_in":["2.7.18-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-5+squeeze7"}]}],"versions":["2.6.2-4","2.6.2-5","2.6.2-5+squeeze1","2.6.2-5+squeeze3","2.6.2-5+squeeze4","2.6.2-5+squeeze5","2.6.2-5+squeeze6"],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openstack:2::el6","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-1.el6ost"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openstack:2::el6","package":"puppet-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-1.el6ost"}]}],"bundled":6}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"puppet","product":"puppet"},{"vendor":"puppet","product":"puppet_enterprise"},{"vendor":"puppetlabs","product":"puppet"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0710.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2013/dsa-2643","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://puppetlabs.com/security/cve/cve-2013-2275/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/52596","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://ubuntu.com/usn/usn-1759-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/58449","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2275","tags":["advisory"]},{"url":"https://puppetlabs.com/security/cve/cve-2013-2275"},{"url":"https://github.com/advisories/GHSA-wwmg-4q3j-qc4f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2275","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0710","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=908629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=919770","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=919773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=919783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=919784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=919785","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0710.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6120","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6120","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1640","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1640","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1652","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1652","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1652","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1654","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1654","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2274","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2274","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2274","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2275","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2275","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-2275","description":"The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.","status":"published","published":"2013-03-20T16:00:00Z","modified":"2024-08-06T15:27:41.177Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2221","description":"The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.","status":"published","published":"2013-03-20T16:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.164386Z"}],"ghsa":[{"id":"GHSA-wwmg-4q3j-qc4f","title":"The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x...","description":"The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.","status":"published","published":"2022-05-14T00:56:51Z","modified":"2025-04-11T04:09:38Z","updated_at":"2026-11-02T15:01:13.537017Z"}],"nvd":[{"id":"CVE-2013-2275","description":"The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.","status":"published","published":"2013-03-20T16:55:01.843Z","modified":"2026-06-16T23:53:04.057Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:24.091325Z"}],"osv":[{"id":"CVE-2013-2275","description":"The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.","status":"published","published":"2013-03-20T16:55:01Z","modified":"2026-04-10T03:42:50.793769Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2275","description":"The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.","status":"published","published":"2013-03-20T16:55:01.843Z","modified":"2026-08-04T06:03:45.204881114Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2643-1","title":"puppet - several issues","status":"published","published":"2013-03-12T00:00:00Z","modified":"2026-03-09T01:18:03.018079Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"RHSA-2013:0710","title":"Red Hat Security Advisory: puppet security update","status":"published","published":"2024-09-15T20:42:58Z","modified":"2026-01-29T10:55:20.533955Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}