CVE-2018-6508

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the factertask or puppetconf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this...

CVE-2018-6508

CVE-2018-6508 affects Puppet Enterprise 2017.3.x before 2017.3.3. It is a remote code execution vulnerability caused by accepting a specially crafted string in the facter_task or puppet_conf tasks. The issue only impacts the affected tasks/modules; if puppet tasks are not used, you may not be aff...

CVE-2017-10690

Puppet Agent vulnerability CVE-2017-10690 allowed retrieving facts from an environment the agent was not classified to access. Root cause: environment leakage within the agent’s fact retrieval. Fixes were implemented in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4; other references ...

CVE-2017-10689

Removed by vendor...

CVE-2017-10690

Removed by vendor...

CVE-2017-10690

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4...

CVE-2017-10690

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4...

CVE-2017-10689: Improper Privilege Management

In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability...

CVE-2017-10690: Improper Privilege Management

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4...

PT-2018-5293

Name of the Vulnerable Software and Affected Versions Puppet Agent versions prior to 5.3.4 Description The issue allowed the Puppet Agent to retrieve facts from an environment it was not classified to access. This was resolved in Puppet Agent 5.3.4, which is included in Puppet Enterprise 2017.3.4...

PT-2018-17598

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2017.3.3 Description The issue is related to a remote execution bug that occurs when a specially crafted string is passed into the facter task or puppet conf tasks. This bug only affects tasks in the affecte...

CVE-2018-6508: Use of Externally-Controlled Format String

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the factertask or puppetconf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this...

CVE-2017-10689

In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability...

RHEL 6 / 7 : Red Hat Satellite 6 (RHSA-2018:0273)

An update is now available for Red Hat Satellite 6.2 for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

Important: Red Hat Security Advisory: Red Hat Satellite 6 security, bug fix, and enhancement update

An update is now available for Red Hat Satellite 6.2 for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

Puppet Enterprise MCollective Server Installs Arbitrary Package Vulnerability

Puppet is a set of configuration management tools based on a client/server C/S architecture from Puppet Labs in the United States, which can be used to manage profiles, users, cron tasks, packages, system services, etc.Puppet Enterprise is an enterprise version.MCollective Server is one of the...

Debian: Security Advisory (DLA-1012-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Puppet Enterprise Incorrect Credential Management Vulnerability

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is an enterprise version. A security vulnerability exists in...

Puppet Enterprise Denial of Service Vulnerability (CNVD-2018-04709)

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is an enterprise version. A security vulnerability exists in...

Puppet Enterprise < 2016.4.4 / 2017 < 2017.2.1 Multiple Vulnerabilities

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 are prone to multiple vulnerabilities. This VT has duplicated the existing VT SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...