Design/Logic Flaw

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority CA certificate during the initial installation and configuration, which might allow local users to obtain sensitive...

CVE-2015-7328

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority CA certificate during the initial installation and configuration, which might allow local users to obtain sensitive...

CVE-2015-7328

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority CA certificate during the initial installation and configuration, which might allow local users to obtain sensitive...

SUSE: Security Advisory for puppet (SUSE-SU-2014:0155-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Puppet Server Contention Condition Vulnerability

Puppet is IT automation software that helps system administrators manage their infrastructure. A contention condition vulnerability exists in Puppet Server 0.2.0 that allows local users to obtain sensitive information by accessing the package installation or upgrade service...

CVE-2014-7170

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service...

Race condition

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service...

CVE-2014-7170

CVE-2014-7170 describes a race condition in Puppet Server 0.2.0 that lets local users access sensitive information during the window between package installation/upgrade and the service start. The root cause is a timing window in the startup/upgrade sequence that can expose data prior to proper i...

CVE-2014-7170

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service...

CVE-2014-7170

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service...

SuSE 11.2 / 11.3 Security Update : puppet / puppet, puppet-server (SAT Patch Numbers 8131 / 8132)

This puppet update fixes a remote code execution issue : - Unauthenticated Remote Code Execution Vulnerability with YAML and REST API calls bug825878, CVE-2013-3567 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE...

Mandriva Linux Security Advisory : puppet (MDVSA-2013:186)

Updated puppet packages fix remote code execution vulnerability When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance o...