Puppet SQL注入漏洞

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the United States, which can be used to manage profiles, users, cron tasks, packages, system services, and more. A SQL injection vulnerability exists in Puppet DB that stems from a flaw...

puppet: puppet server and puppetDB may leak sensitive information via metrics API

A flaw was found where the metrics API endpoints of Puppet Server and PuppetDB leaked sensitive information to the local network. Listening to these network endpoints could allow attackers the ability to exploit additional computer systems. The highest impact of this flaw is confidentiality...