CVE-2014-3251

2014-08-1223:55:00

Debian Security Bug Tracker

security-tracker.debian.org

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%

JSON

The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.

OSVersionArchitecturePackageVersionFilename
Debian12allmcollective< 2.6.0+dfsg-1mcollective_2.6.0+dfsg-1_all.deb
Debian11allmcollective< 2.6.0+dfsg-1mcollective_2.6.0+dfsg-1_all.deb
Debian10allmcollective< 2.6.0+dfsg-1mcollective_2.6.0+dfsg-1_all.deb
Debian999allmcollective< 2.6.0+dfsg-1mcollective_2.6.0+dfsg-1_all.deb
Debian13allmcollective< 2.6.0+dfsg-1mcollective_2.6.0+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mcollective	< 2.6.0+dfsg-1	mcollective_2.6.0+dfsg-1_all.deb
Debian	11	all	mcollective	< 2.6.0+dfsg-1	mcollective_2.6.0+dfsg-1_all.deb
Debian	10	all	mcollective	< 2.6.0+dfsg-1	mcollective_2.6.0+dfsg-1_all.deb
Debian	999	all	mcollective	< 2.6.0+dfsg-1	mcollective_2.6.0+dfsg-1_all.deb
Debian	13	all	mcollective	< 2.6.0+dfsg-1	mcollective_2.6.0+dfsg-1_all.deb