Skip to content

Puppetlabs vulnerabilities

Products

Newest

puppet enterprise, puppetlabs puppet enterprise +1 more The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not... CVE-2016-2787 5.3 MediumFebruary 13, 2017
puppetlabs mcollective-puppet-agent The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute... CVE-2015-7331 6.6 MediumJanuary 30, 2017
puppet facter Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata CVE-2015-1426 Fix available 2.1 LowFebruary 23, 2015
puppet enterprise, puppetlabs mcollective +1 more The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective... CVE-2014-3251 Fix available 4.4 MediumAugust 12, 2014
puppet facter, hiera, puppet +2 more +4 more facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability CVE-2014-3248 Fix available 6.2 MediumJune 30, 2014
puppet enterprise, puppetlabs puppet +1 more Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2... CVE-2013-1399 6.8 MediumMarch 14, 2014
puppet enterprise, puppetlabs puppet +1 more The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict... CVE-2013-1398 8.5 HighMarch 14, 2014
puppet enterprise, puppetlabs puppet +1 more Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret... CVE-2012-5158 4.0 MediumMarch 14, 2014
puppet enterprise, puppetlabs puppet, canonical ubuntu linux +1 more +3 more Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3... CVE-2013-4969 Fix available 2.1 LowDecember 31, 2013
puppet, puppet enterprise +1 more Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and... CVE-2013-4956 Fix available 3.6 LowAugust 20, 2013
puppet, puppet enterprise +1 more Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service CVE-2013-4761 Fix available 5.1 MediumAugust 20, 2013
puppet, puppet enterprise, canonical ubuntu linux +2 more +4 more Puppet Improper Input Validation vulnerability CVE-2013-3567 Fix available 7.5 HighJune 26, 2013
puppet enterprise, puppetlabs puppet +1 more Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client... CVE-2013-2716 5.0 MediumApril 10, 2013
puppet, puppet enterprise, canonical ubuntu linux +2 more The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x... CVE-2013-2275 Fix available 4.0 MediumMarch 12, 2013
puppet, puppet enterprise +1 more Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated... CVE-2013-2274 Fix available 6.5 MediumMarch 12, 2013
puppet, puppet enterprise +1 more Puppet Improper Input Validation vulnerability CVE-2013-1655 Fix available 7.5 HighMarch 12, 2013
puppet, puppet enterprise, canonical ubuntu linux +2 more Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does... CVE-2013-1654 Fix available 5.0 MediumMarch 12, 2013
puppet, puppet enterprise, canonical ubuntu linux +2 more Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1... CVE-2013-1653 Fix available 7.1 HighMarch 12, 2013
puppet, puppet enterprise, canonical ubuntu linux +2 more Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1... CVE-2013-1652 Fix available 4.9 MediumMarch 12, 2013
puppet enterprise, puppetlabs puppet +1 more Puppet supports use of IP addresses in certnames without warning of potential risks CVE-2012-3408 Fix available 2.6 LowAugust 6, 2012
puppet, puppet enterprise, canonical ubuntu linux +4 more +6 more Pupper does not properly restrict characters in Common Name field of Certificate Signing Request CVE-2012-3867 Fix available 4.3 MediumJuly 12, 2012
puppet, puppet enterprise +1 more Puppet allows local users to obtain sensitive configuration information CVE-2012-3866 Fix available 2.1 LowJuly 12, 2012
puppet, puppet enterprise +1 more Puppet vulnerable to Path Traversal CVE-2012-3865 Fix available 3.5 LowJuly 12, 2012
puppet, puppet enterprise +1 more Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote... CVE-2012-3864 Fix available 4.0 MediumJuly 12, 2012
puppet, puppet enterprise +1 more Puppet allows local users to overwrite arbitrary files via a symlink attack CVE-2012-1989 Fix available 3.6 LowJune 27, 2012
puppet, puppet enterprise, puppetlabs puppet enterprise users +2 more Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1... CVE-2012-1986 Fix available 2.1 LowApril 13, 2012
puppet, puppet enterprise, puppetlabs puppet enterprise users +2 more Puppet uses predictable filenames, allowing arbitrary file overwrite CVE-2012-1906 Fix available 3.3 LowApril 13, 2012
puppet, puppet enterprise, puppetlabs puppet enterprise users +2 more Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1... CVE-2012-1054 Fix available 4.4 MediumFebruary 27, 2012
puppet, puppet enterprise, puppetlabs puppet enterprise users +2 more Puppet Privilege Escallation CVE-2012-1053 Fix available 6.9 MediumFebruary 27, 2012
puppet, puppet enterprise, puppetlabs puppet enterprise users +2 more Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and... CVE-2011-3872 Public exploitFix available 2.6 LowOctober 27, 2011
puppet Puppet uses predictable filenames, allowing arbitrary file overwrite CVE-2011-3871 Fix available 6.2 MediumSeptember 29, 2011
puppet Puppet allows local users to modify the permissions of arbitrary files CVE-2011-3870 Fix available 6.3 MediumSeptember 29, 2011
puppet Puppet arbitrary file overwrite CVE-2011-3869 Fix available 6.3 MediumSeptember 29, 2011
puppet Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows... CVE-2011-3848 Fix available 5.0 MediumSeptember 29, 2011