puppet vulnerabilities and fixes

Recent CVEs affecting puppet, with upgrade or downgrade steps. 35 tracked.

puppet has 35 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 27. Most recent: 2021-11-18. Highest priority: CVE-2016-2785 (score 61/100).

• CVE-2021-27026 MEDIUM 4.4 UPGRADE UPGRADE A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logge
• CVE-2021-27025 MEDIUM 6.5 UPGRADE UPGRADE A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable
• CVE-2021-27022 MEDIUM 4.9 UPGRADE UPGRADE A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those s
• CVE-2021-27021 HIGH 8.8 UPGRADE UPGRADE A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to
• CVE-2020-7942 MEDIUM 6.5 UPGRADE UPGRADE Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in
• CVE-2018-6515 HIGH 7.8 UPGRADE Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2
• CVE-2018-6514 HIGH 7.8 UPGRADE In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2,
• CVE-2018-6513 HIGH 8.8 UPGRADE UPGRADE Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise
• CVE-2017-2295 HIGH 8.2 UPGRADE MITIGATE Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this c
• CVE-2017-10690 MEDIUM 6.5 UPGRADE UPGRADE In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that
• CVE-2017-10689 MEDIUM 5.5 UPGRADE UPGRADE In previous versions of Puppet Agent it was possible to install a module with world writable permissions
• CVE-2016-2785 CRITICAL 9.8 DOWNGRADE DOWNGRADE Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 m
• CVE-2014-3250 MEDIUM 6.5 UPGRADE MITIGATE The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directiv
• CVE-2014-3248 MEDIUM 6.2 DOWNGRADE UPGRADE Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before
• CVE-2013-4969 LOW 2.1 UPGRADE UPGRADE Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows l
• CVE-2013-4956 LOW 3.6 DOWNGRADE DOWNGRADE Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise
• CVE-2013-4761 MEDIUM 5.1 DOWNGRADE DOWNGRADE Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x be
• CVE-2013-3567 HIGH 7.5 DOWNGRADE DOWNGRADE Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted
• CVE-2013-2716 MEDIUM 5.0 UPGRADE DOWNGRADE Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (c
• CVE-2013-2275 MEDIUM 4.0 DOWNGRADE UPGRADE The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, an
• CVE-2013-2274 MEDIUM 6.5 DOWNGRADE DOWNGRADE Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execu
• CVE-2013-1655 HIGH 7.5 DOWNGRADE DOWNGRADE Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers t
• CVE-2013-1654 MEDIUM 5.0 DOWNGRADE DOWNGRADE Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly
• CVE-2013-1653 HIGH 7.1 UPGRADE DOWNGRADE Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.
• CVE-2013-1652 MEDIUM 4.9 UPGRADE DOWNGRADE Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.
• CVE-2013-1640 HIGH 9.0 UPGRADE UPGRADE The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before
• CVE-2013-1399 MEDIUM 6.8 UPGRADE DOWNGRADE Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live manage
• CVE-2013-1398 HIGH 8.5 UPGRADE DOWNGRADE The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalo
• CVE-2012-5158 MEDIUM 4.0 UPGRADE DOWNGRADE Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed,
• CVE-2012-3867 MEDIUM 4.3 DOWNGRADE UPGRADE lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise
• CVE-2012-3866 LOW 2.1 DOWNGRADE UPGRADE lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permission
• CVE-2012-3865 LOW 3.5 DOWNGRADE UPGRADE Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.
• CVE-2012-3864 MEDIUM 4.0 DOWNGRADE UPGRADE Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated
• CVE-2012-3408 LOW 2.6 UPGRADE UPGRADE lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of I
• CVE-2011-0528 MEDIUM 5.5 DOWNGRADE Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authentica

FAQ

How do I fix puppet vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is puppet being exploited right now?

None of the tracked puppet CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which puppet CVE should I patch first?

CVE-2016-2785 currently ranks highest (61/100): Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 m.

RSS feed for puppet · ← Back to latest CVEs