{"id":"CVE-2015-1029","aliases":["AZL-44415","DEBIAN-CVE-2015-1029","EUVD-2015-1173","GHSA-g3q8-3w6w-q3m9","UBUNTU-CVE-2015-1029"],"status":"published","title":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8...","description":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01647,"percentile":0.76636,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2015-01-16T16:00:00Z","modified":"2026-09-21T16:00:05Z","fixes":[{"ecosystem":"Azure Linux:3","package":"puppet","fixed_in":["7.34.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"puppet-module-puppetlabs-stdlib","fixed_in":["4.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"puppet-module-puppetlabs-stdlib","fixed_in":["4.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"puppet-module-puppetlabs-stdlib","fixed_in":["4.9.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"puppet-module-puppetlabs-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"puppet-module-puppetlabs-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"puppet-module-puppetlabs-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-1"}]}]}],"products":[{"vendor":"puppet","product":"stdlib"}],"references":[{"url":"http://puppetlabs.com/security/cve/cve-2015-1029","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://secunia.com/advisories/62328","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1029","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g3q8-3w6w-q3m9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1029","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1029","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1029","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1029","description":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.","status":"published","published":"2015-01-16T16:00:00Z","modified":"2024-08-06T04:33:19.249Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1173","description":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.","status":"published","published":"2015-01-16T16:00:00Z","modified":"2024-08-06T04:33:19Z","updated_at":"2026-11-03T02:22:17.03063Z"}],"ghsa":[{"id":"GHSA-g3q8-3w6w-q3m9","title":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8...","description":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.","status":"published","published":"2022-05-14T00:56:47Z","modified":"2023-02-02T05:02:53Z","updated_at":"2026-11-02T14:51:31.853894Z"}],"nvd":[{"id":"CVE-2015-1029","description":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.","status":"published","published":"2015-01-16T16:59:22.093Z","modified":"2026-06-17T00:21:39.12Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:01.643178Z"}],"osv":[{"id":"AZL-44415","title":"CVE-2015-1029 affecting package puppet for versions less than 7.34.0-1","description":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.","status":"published","published":"2015-01-16T16:59:22Z","modified":"2026-04-21T04:53:36.145649Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"CVE-2015-1029","description":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.","status":"published","published":"2015-01-16T16:59:22Z","modified":"2026-04-10T03:45:05.869784Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-1029","description":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.","status":"published","published":"2015-01-16T16:59:22.093Z","modified":"2026-09-21T16:00:05.727593909Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2015-1029","description":"The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.","status":"withdrawn","published":"2015-01-16T16:59:00Z","modified":"2025-07-16T08:11:21.403236Z","updated_at":"2026-11-02T15:54:09.721803Z"}]}}