Skip to content
OpenAdvisories
Unscored CVE-2018-6508 EUVD-2018-18264GHSA-j433-wpfx-cxg3

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the f…

Published Feb 9, 2018 · Updated Sep 17, 2024 · Assigned by puppet

Vendor: Puppet Product: Puppet Enterprise Product: puppetlabs-apache Product: puppetlabs-apt Product: puppetlabs-mysql Product: puppetlabs/facter_task Product: puppetlabs/puppet_conf Package: puppet-module-puppetlabs-apache Package: puppet-module-puppetlabs-apache Package: puppet-module-puppetlabs-apt Package: puppet-module-puppetlabs-apt Package: puppet-module-puppetlabs-mysql Package: puppet-module-puppetlabs-mysql Ecosystem: Debian Ecosystem: Ubuntu

Description

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.

Affected products

VendorProductAffectedFixed
Puppet Puppet Enterprise 2017.3.x prior to 2017.3.4 —
Puppet puppetlabs/facter_task prior to 0.1.5 —
Puppet puppetlabs/puppet_conf prior to 0.1.5 —
Puppet puppetlabs/apt prior to 4.5.1 —
Puppet puppetlabs/mysql prior to 5.2.1 —
Puppet puppetlabs/apache prior to 2.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 puppet-module-puppetlabs-apt 4.5.1-1 —
Debian 14 puppet-module-puppetlabs-mysql 5.3.0-1 —
Debian 13 puppet-module-puppetlabs-apache 3.0.0-1 —
Debian 13 puppet-module-puppetlabs-apt 4.5.1-1 —
Debian 13 puppet-module-puppetlabs-mysql 5.3.0-1 —
Debian 12 puppet-module-puppetlabs-apache 3.0.0-1 —
Debian 12 puppet-module-puppetlabs-apt 4.5.1-1 —
Debian 12 puppet-module-puppetlabs-mysql 5.3.0-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 puppet-module-puppetlabs-apt +2 No fix yet —
Ubuntu 26.04 LTS puppet-module-puppetlabs-apt +2 No fix yet —
Ubuntu 25.10 puppet-module-puppetlabs-apt +2 No fix yet —
Ubuntu 24.04 LTS puppet-module-puppetlabs-apt +2 No fix yet —
Ubuntu 22.04 LTS puppet-module-puppetlabs-apt +2 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS puppet-module-puppetlabs-apt +2 No fix yet —
Ubuntu 18.04 LTS puppet-module-puppetlabs-apt +2 No fix yet —
Ubuntu 16.04 LTS puppet-module-puppetlabs-apt +2 No fix yet —

References