Puppet Enterprise

16 results · Feed

• Medium 6.8
  CVE-2023-5309

  Broken Session Management in Puppet Enterprise

  Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.

  Puppet Puppet Enterprise
  Nov 7, 2023
• Medium 4.4
  CVE-2023-5255

  Denial of Service for Revocation of Auto Renewed Certificates

  For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.

  Puppet Puppet Enterprise puppet Ubuntu
  Oct 3, 2023
• Unscored —
  CVE-2023-2530

  A privilege escalation allowing remote code execution was discovered in the orchestration service.

  Puppet Puppet Enterprise
  Jun 7, 2023
• Medium 5.3
  CVE-2023-1894

  A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An i…

  Puppet Puppet Enterprise Puppet server puppet Debian Ubuntu
  May 4, 2023
• Unscored —
  CVE-2018-11749

  When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext …

  Puppet Puppet Enterprise
  Aug 24, 2018
• Medium 5.4
  CVE-2018-6511

  XSS Vulnerability in Puppet Enterprise Console

  A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Puppet Enterprise Console. Affected releases are Puppet Puppet Enterprise: 2017.3.x versio…

  Puppet Puppet Enterprise
  May 8, 2018
• Medium 5.4
  CVE-2018-6510

  XSS Vulnerability in Puppet Enterprise Console

  A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Orchestrator. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2…

  Puppet Puppet Enterprise
  May 8, 2018
• Unscored —
  CVE-2018-6508

  Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string w…

  Puppet Puppet Enterprise puppetlabs-apache puppetlabs-mysql Debian Ubuntu
  Feb 9, 2018
• Unscored —
  CVE-2017-10690

  In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was no…

  Puppet Puppet Enterprise Puppet Agent
  Feb 9, 2018
• Medium 5.5
  CVE-2017-10689

  Tarball permission preservation in puppet

  In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

  Puppet Puppet Enterprise Puppet Agent puppet Debian Ubuntu RubyGems
  Feb 9, 2018
• Unscored —
  CVE-2017-2296

  In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Cla…

  Puppet Puppet Enterprise
  Feb 1, 2018
• Unscored —
  CVE-2017-2293

  Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the …

  Puppet Puppet Enterprise
  Feb 1, 2018
• Unscored —
  CVE-2017-2297

  Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled…

  Puppet Puppet Enterprise
  Feb 1, 2018
• Unscored —
  CVE-2016-5716

  The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allo…

  Puppet Puppet Enterprise
  Aug 9, 2017
• Unscored —
  CVE-2017-2294

  Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive…

  Puppet Puppet Enterprise
  Jul 5, 2017
• Unscored —
  CVE-2016-9686

  The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this …

  Puppet Puppet Enterprise
  Feb 8, 2017