Skip to content
OpenAdvisories
Unscored USN-3308-1 2 CVEs

puppet vulnerabilities

Published Jun 5, 2017 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Dennis Rowe discovered that Puppet incorrectly handled the search path. A
local attacker could use this issue to possibly execute arbitrary code.
(CVE-2014-3248)

It was discovered that Puppet incorrectly handled YAML deserialization. A
remote attacker could possibly use this issue to execute arbitrary code on
the master. This update is incompatible with agents older than 3.2.2.
(CVE-2017-2295)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS puppet 3.4.3-1ubuntu1.2

Vulnerabilities 2

  • Medium —
    CVE-2014-3248

    facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

    Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local us…

    puppet puppet mcollective facter Debian Ubuntu RubyGems
  • Unscored —
    CVE-2017-2295

    Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with…

    Puppet Puppet server puppet puppet Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-3248
  • report
    https://ubuntu.com/security/CVE-2017-2295