PatchTheCVEpuppetlabs vulnerabilities
Recent CVEs affecting puppetlabs products. 24 tracked.
puppetlabs has 24 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 16. Most recent: 2017-02-13. Highest priority: CVE-2013-3567 (score 53/100).
- CVE-2016-2787 MEDIUM 5.3 DOWNGRADE DOWNGRADE The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate ce
- CVE-2015-7331 MEDIUM 6.6 UPGRADE The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code
- CVE-2015-1426 LOW 2.1 DOWNGRADE DOWNGRADE Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadat
- CVE-2014-3251 MEDIUM 4.4 UPGRADE MITIGATE The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, d
- CVE-2014-3248 MEDIUM 6.2 DOWNGRADE UPGRADE Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before
- CVE-2013-4969 LOW 2.1 UPGRADE UPGRADE Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows l
- CVE-2013-4956 LOW 3.6 DOWNGRADE DOWNGRADE Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise
- CVE-2013-4761 MEDIUM 5.1 DOWNGRADE DOWNGRADE Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x be
- CVE-2013-3567 HIGH 7.5 DOWNGRADE DOWNGRADE Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted
- CVE-2013-2716 MEDIUM 5.0 UPGRADE DOWNGRADE Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (c
- CVE-2013-2275 MEDIUM 4.0 DOWNGRADE UPGRADE The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, an
- CVE-2013-2274 MEDIUM 6.5 DOWNGRADE DOWNGRADE Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execu
- CVE-2013-1655 HIGH 7.5 DOWNGRADE DOWNGRADE Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers t
- CVE-2013-1654 MEDIUM 5.0 DOWNGRADE DOWNGRADE Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly
- CVE-2013-1653 HIGH 7.1 UPGRADE DOWNGRADE Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.
- CVE-2013-1652 MEDIUM 4.9 UPGRADE DOWNGRADE Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.
- CVE-2013-1399 MEDIUM 6.8 UPGRADE DOWNGRADE Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live manage
- CVE-2013-1398 HIGH 8.5 UPGRADE DOWNGRADE The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalo
- CVE-2012-5158 MEDIUM 4.0 UPGRADE DOWNGRADE Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed,
- CVE-2012-3867 MEDIUM 4.3 DOWNGRADE UPGRADE lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise
- CVE-2012-3866 LOW 2.1 DOWNGRADE UPGRADE lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permission
- CVE-2012-3865 LOW 3.5 DOWNGRADE UPGRADE Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.
- CVE-2012-3864 MEDIUM 4.0 DOWNGRADE UPGRADE Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated
- CVE-2012-3408 LOW 2.6 UPGRADE UPGRADE lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of I
FAQ
How do I fix puppetlabs vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is puppetlabs being exploited right now?
None of the tracked puppetlabs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which puppetlabs CVE should I patch first?
CVE-2013-3567 currently ranks highest (53/100): Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted .