Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

puppetlabs puppet 1.2.0 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2013-2716
Puppet Labs Puppet Enterprise prior to 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote malicious users to obtain console access via a crafted cookie.
Puppet Puppet Enterprise 2.5.2Puppetlabs Puppet 2.6.0Puppet Puppet Enterprise 2.5.1Puppetlabs Puppet 2.5.0Puppet Puppet EnterprisePuppetlabs Puppet 1.1.0Puppetlabs Puppet 1.0.0Puppet Puppet Enterprise 2.0.0Puppetlabs Puppet 1.2.0
7.5
CVSSv3
CVE-2017-2299
Versions of the puppetlabs-apache module before 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust ce...
Puppet Puppetlabs-apache 1.4.1Puppet Puppetlabs-apache 1.4.0Puppet Puppetlabs-apache 1.3.0Puppet Puppetlabs-apache 1.2.0Puppet Puppetlabs-apache 0.0.4Puppet Puppetlabs-apache 1.7.0Puppet Puppetlabs-apache 1.5.0Puppet Puppetlabs-apache 1.1.1Puppet Puppetlabs-apache 1.0.1Puppet Puppetlabs-apache 0.7.0Puppet Puppetlabs-apache 0.4.0Puppet Puppetlabs-apache 2.0.0Puppet Puppetlabs-apache 1.11.0Puppet Puppetlabs-apache 1.10.0Puppet Puppetlabs-apache 1.8.1Puppet Puppetlabs-apache 1.8.0Puppet Puppetlabs-apache 0.11.0Puppet Puppetlabs-apache 0.10.0Puppet Puppetlabs-apache 0.9.0Puppet Puppetlabs-apache 0.8.1Puppet Puppetlabs-apache 1.7.1Puppet Puppetlabs-apache 1.6.0
NA
CVE-2013-3567
Puppet 2.7.x prior to 2.7.22 and 3.2.x prior to 3.2.2, and Puppet Enterprise prior to 2.8.2, deserializes untrusted YAML, which allows remote malicious users to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Puppetlabs Puppet 2.7.1Puppet Puppet 2.7.10Puppet Puppet 2.7.18Puppetlabs Puppet 2.7.19Puppetlabs Puppet 3.2.0Puppet Puppet 2.7.13Puppet Puppet 2.7.14Puppetlabs Puppet 2.7.20Puppet Puppet 2.7.21Puppet Puppet 2.7.11Puppet Puppet 2.7.12Puppet Puppet 2.7.2Puppet Puppet 3.2.1Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.16Puppet Puppet 2.7.17Canonical Ubuntu Linux 12.10Canonical Ubuntu Linux 12.04Canonical Ubuntu Linux 13.04Novell Suse Linux Enterprise Server 11.0Novell Suse Linux Enterprise Desktop 11.0Novell Suse Linux Enterprise Desktop 11
NA
CVE-2013-1653
Puppet prior to 2.6.18, 2.7.x prior to 2.7.21, and 3.1.x prior to 3.1.1, and Puppet Enterprise prior to 1.2.7 and 2.7.x prior to 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authentica...
Puppet PuppetPuppet Puppet 2.7.11Puppet Puppet 2.7.12Puppet Puppet 2.7.13Puppet Puppet 2.7.14Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.7Puppet Puppet 2.7.9Puppet Puppet 2.7.17Puppetlabs Puppet 2.7.19Puppetlabs Puppet 2.7.1Puppet Puppet 2.7.6Puppet Puppet 2.7.8Puppet Puppet 2.7.10Puppet Puppet 2.7.16Puppet Puppet 2.7.18Puppet Puppet 2.7.2Puppet Puppet 2.7.3Puppet Puppet 2.7.4Puppet Puppet 2.7.5Puppetlabs Puppet 2.7.20Puppet Puppet Enterprise 3.1.0
NA
CVE-2011-3872
Puppet 2.6.x prior to 2.6.12 and 2.7.x prior to 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 prior to 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which all...
Puppet Puppet 2.6.1Puppet Puppet 2.6.8Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.4Puppet Puppet 2.6.9Puppet Puppet 2.6.10Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet 2.7.3Puppet Puppet 2.7.5Puppet Puppet 2.6.0Puppet Puppet 2.6.4Puppet Puppet 2.6.5Puppet Puppet 2.6.11Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.7.2Puppetlabs Puppet 2.7.1Puppet Puppet Enterprise 1.2.2Puppet Puppet Enterprise 1.2.3Puppetlabs Puppet Enterprise Users 1.0Puppet Puppet Enterprise 1.2.0
NA
CVE-2012-1053
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x prior to 2.6.14 and 2.7.x prior to 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x prior to 2.0.3 does not properly manage group privileges, which allows local users to gain...
Puppet Puppet 2.6.13Puppet Puppet 2.6.5Puppet Puppet 2.6.4Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.8Puppet Puppet 2.6.1Puppet Puppet 2.6.0Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.4Puppet Puppet 2.7.3Puppet Puppet 2.7.5Puppet Puppet 2.7.2Puppet Puppet 2.7.10Puppetlabs Puppet 2.7.1
NA
CVE-2012-1054
Puppet 2.6.x prior to 2.6.14 and 2.7.x prior to 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x prior to 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
Puppet Puppet 2.6.11Puppet Puppet 2.6.10Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet 2.6.13Puppet Puppet 2.6.12Puppet Puppet 2.6.5Puppet Puppet 2.6.4Puppet Puppet 2.6.9Puppet Puppet 2.6.8Puppet Puppet 2.6.1Puppet Puppet 2.6.0Puppet Puppet 2.7.10Puppet Puppet 2.7.9Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.4Puppet Puppet 2.7.8Puppet Puppet 2.7.7Puppet Puppet 2.7.3Puppet Puppet 2.7.2
NA
CVE-2012-1989
telnet.rb in Puppet 2.7.x prior to 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
Puppet Puppet 2.7.8Puppet Puppet 2.7.6Puppet Puppet 2.7.11Puppet Puppet 2.7.9Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.12Puppet Puppet 2.7.4Puppet Puppet 2.7.3Puppetlabs Puppet 2.7.1Puppet Puppet 2.7.10Puppet Puppet 2.7.5Puppet Puppet Enterprise 1.2.1Puppet Puppet Enterprise 1.2.4Puppet Puppet Enterprise 2.0.1Puppet Puppet Enterprise 2.5.0Puppet Puppet Enterprise 2.0.0Puppet Puppet Enterprise 2.0.2Puppet Puppet Enterprise 1.2.2Puppet Puppet Enterprise 1.2.0Puppet Puppet Enterprise 1.2.3
NA
CVE-2012-1906
Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or i...
Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.6.13Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.3Puppet Puppet 2.7.11Puppet Puppet 2.7.7Puppet Puppet 2.7.6Puppet Puppet 2.7.5
NA
CVE-2012-1986
Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlin...
Puppet Puppet 2.6.13Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.7.10Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.4Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.3Puppet Puppet 2.7.11
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3581reflected XSSCVE-2024-26925CVE-2024-27956LFICVE-2024-3607CVE-2024-3107CVE-2024-3295SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook