14 results · Feed
-
Critical 9.4
Report Deserialization Code Execution
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by sub…
-
Medium 4.3
Authenticated users may view private Puppet module metadata
An authenticated user may view private Puppet module metadata without repository read access.
-
Medium 4.4
Denial of Service for Revocation of Auto Renewed Certificates
For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.
-
Medium 5.3
A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An i…
-
Medium 6.5
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
-
Medium 6.5
Silent Configuration Failure in Puppet Agent
A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
-
Unscored —
A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive …
-
Unscored —
The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed …
-
Unscored —
Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.
-
Unscored —
Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For Pu…
-
Medium 5.5
Tarball permission preservation in puppet
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.
-
Unscored —
The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which …
-
Unscored —
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with…
-
Medium —
facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local us…