Skip to content
OpenAdvisories

Vendor

Puppet

37 known vulnerabilities.

Products

Puppet Enterprise 16 Puppet Agent 6 puppetlabs-apt 2 Puppet Discovery 2 Bolt 2 puppetlabs-apache 2 puppetlabs-mysql 2 Puppet server 2 Firewall Module 1 mcollective-puppet-agent plugin 1 PEADM Forge Module 1 mcollective 1 Puppet Enterprise 2018.1.x prior to 2018.1.1, razor-server and pe-razor-server prior to 1.9.0.0 1 Puppet 1 Chloride 1 pe-client-tools 1 Puppet Enterprise and Puppet Agent 1 mcollective, Puppet, Puppet Enterprise 1 puppetlabs/facter_task 1 puppetlabs/puppet_conf 1 Puppet < 2021.7.6 0 Puppet < 2023.5 0 Puppet Enterprise < 2023.4 0 Puppet Server < 8.2.3 0
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.4
    CVE-2022-3276

    Puppetlabs-mysql Command Injection

    Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppe…

    Puppet puppetlabs-mysql puppet-module-puppetlabs-mysql puppet-module-puppetlabs-mysql Debian Ubuntu
  • High 8.4
    CVE-2022-3275

    Puppetlabs-apt Command Injection

    Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet a…

    Puppet puppetlabs-apt puppet-module-puppetlabs-apt puppet-module-puppetlabs-apt Debian Ubuntu
  • High 7.5
    CVE-2018-6517

    Improper Certificate Validation in chloride

    Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated…

    Puppet Chloride chloride RubyGems
  • High 8.6
    CVE-2018-11746

    Puppet Discovery can leak authentication information

    In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discove…

    Puppet Puppet Discovery