Published: 12/08/2014 Updated: 10/07/2019

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

VMScore: 392

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

The MCollective aes_security plugin, as used in Puppet Enterprise prior to 3.3.0 and Mcollective prior to 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.

Vulnerable Product	Search on Vulmon	Subscribe to Product
puppet puppet enterprise
puppetlabs mcollective -

Debian Bug report logs - #758701 CVE-2014-3251 Package: src:mcollective; Maintainer for src:mcollective is Puppet Package Maintainers <pkg-puppet-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Wed, 20 Aug 2014 10:09:01 UTC Severity: important Tags: security Fixed in version mc ...

Debian Bug report logs - #850968 CVE-2016-2788 Package: src:mcollective; Maintainer for src:mcollective is Puppet Package Maintainers <pkg-puppet-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Wed, 11 Jan 2017 17:27:02 UTC Severity: grave Tags: fixed-upstream, security, upstrea ...

Debian Bug report logs - #866711 mcollective: CVE-2017-2292: Remote code execution via YAML deserialization Package: src:mcollective; Maintainer for src:mcollective is Puppet Package Maintainers <pkg-puppet-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 1 Jul 2017 06: ...

The MCollective aes_security plugin, as used in Puppet Enterprise before 330 and Mcollective before 253, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition ...

CWE-362 http://puppetlabs.com/security/cve/cve-2014-3251 http://secunia.com/advisories/60066 http://secunia.com/advisories/59356 http://www.osvdb.org/109257 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758701 https://access.redhat.com/security/cve/cve-2014-3251

CVE-2014-3251

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect