RSS   Vulnerabilities for 'Puppet enterprise'   RSS

2021-08-30
 
CVE-2021-27019

CWE-532
 
 
PuppetDB logging included potentially sensitive system information.

 
 
CVE-2021-27020

CWE-1236
 
 
Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.

 
2020-02-27
 
CVE-2015-5686

CWE-1021
 
 
Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session.

 
2019-12-11
 
CVE-2013-4968

CWE-79
 
 
Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct cross-site scripting (XSS) attacks via unspecified vectors related to "live management."

 
2019-11-29
 
CVE-2015-1855

CWE-20
 
 
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

 
2018-02-09
 
CVE-2017-10689

CWE-269
 
 
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

 
2017-10-18
 
CVE-2016-5714

CWE-284
 
 
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability."

 
2017-08-09
 
CVE-2016-5716

CWE-134
 
 
The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.

 
2017-02-13
 
CVE-2016-2787

CWE-284
 
 
The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors.

 
2017-02-08
 
CVE-2016-9686

CWE-20
 
 
The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2.

 

Copyright 2024, cxsecurity.com

 

Back to Top