Published: 20/03/2013 Updated: 10/07/2019

CVSS v2 Base Score: 4.9 | Impact Score: 4.9 | Exploitability Score: 6.8

VMScore: 436

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N

Puppet prior to 2.6.18, 2.7.x prior to 2.7.21, and 3.1.x prior to 3.1.1, and Puppet Enterprise prior to 1.2.7 and 2.7.x prior to 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
puppetlabs puppet
puppet puppet 2.7.11
puppet puppet 2.7.18
puppet puppet 2.7.17
puppet puppet 2.7.13
puppetlabs puppet 2.7.19
puppetlabs puppet 2.7.20
puppet puppet 2.7.14
puppetlabs puppet 2.7.1
puppet puppet 2.7.9
puppet puppet 2.7.3
puppet puppet 2.7.10
puppetlabs puppet 2.7.0
puppet puppet 2.7.7
puppet puppet 2.7.5
puppet puppet 2.7.8
puppet puppet 2.7.6
puppet puppet 2.7.16
puppet puppet 2.7.2
puppet puppet 2.7.4
puppet puppet 2.7.12
puppet puppet enterprise 3.1.0
puppet puppet enterprise 2.7.0
puppet puppet enterprise 2.7.1
canonical ubuntu linux 11.10
canonical ubuntu linux 12.10
canonical ubuntu linux 12.04

Synopsis Important: puppet security update Type/Severity Security Advisory: Important Topic Updated puppet packages that fix several security issues are now availablefor Red Hat OpenStack FolsomThe Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability ...

Several security issues were fixed in Puppet ...

Multiple vulnerabilities were discovered in Puppet, a centralized configuration management system CVE-2013-1640 An authenticated malicious client may request its catalog from the puppet master, and cause the puppet master to execute arbitrary code The puppet master must be made to invoke the template or inline_template functions ...

CWE-264 http://www.securityfocus.com/bid/58443 https://puppetlabs.com/security/cve/cve-2013-1652/http://www.debian.org/security/2013/dsa-2643 http://ubuntu.com/usn/usn-1759-1 http://secunia.com/advisories/52596 http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0710.html https://access.redhat.com/errata/RHSA-2013:0710 https://usn.ubuntu.com/1759-1/https://nvd.nist.gov

CVE-2013-1652

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect