Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 6.0 | puppet | 2.6.2-5+squeeze6 |
Vulnerabilities 4
-
Unscored —
Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to …
-
Low —
Puppet vulnerable to Path Traversal
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppe…
-
Low —
Puppet allows local users to obtain sensitive configuration information
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server t…
-
Medium —
Pupper does not properly restrict characters in Common Name field of Certificate Signing Request
lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for u…