PT-2017-8750

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2015.3.3 and 2016.x before 2016.4.0 Puppet Agent versions 1.3.6 through 1.7.0 Description The issue allows remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on nodes via...

CVE-2016-5714: Improper Access Control

Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol PXP Command...

GLSA-201710-12 : Puppet Agent: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201710-12 Puppet Agent: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Puppet Agent. Please review the references for details. Impact : A remote attacker could possibly execute arbitrary code with the...

Puppet Agent: Multiple vulnerabilities

Background Puppet Agent contains Puppet’s main code and all of the dependencies needed to run it, including Facter, Hiera, and bundled versions of Ruby and OpenSSL. Description Multiple vulnerabilities have been discovered in Puppet Agent. Please review the references for details. Impact A remote...

Puppet Enterprise console remote code execution vulnerability

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is an enterprise version. console is one of the console tools. ...

SUSE SLED12 Security Update : puppet (SUSE-SU-2017:2113-1)

This update for puppet fixes the following issues: Security issue fixed : - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as...

CVE-2016-5716

The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node...

Remote code execution

The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node...

CVE-2016-5716

The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node...

CVE-2016-5716

CVE-2016-5716 affects Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0. The vulnerability stems from unsafe string reads in the console, which potentially permits remote code execution on the console node. The issue has been reported across multiple sources (NVD entry and CNVD/CVE records) w...

CVE-2016-5716

The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node...

CVE-2016-5716

Removed by vendor...

CVE-2016-5716

The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node...

SUSE-SU-2017:2113-1 Security update for puppet

This update for puppet fixes the following issues: Security issue fixed: - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as t...

CVE-2016-5716: Use of Externally-Controlled Format String

The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node...

PT-2017-8751

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2015.x through 2016.3.x Description The issue concerns unsafe string reads in the console of Puppet Enterprise, potentially allowing for remote code execution on the console node. Recommendations For Puppet Enterpris...

openSUSE Security Update : rubygem-puppet (openSUSE-2017-835)

This update for rubygem-puppet fixes the following issues : - CVE-2017-2295: A remote attacker could have forced unsafe YAML deserialization which could have led to code execution bsc1040151 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Security update for rubygem-puppet (important)

This update for rubygem-puppet fixes the following issues: - CVE-2017-2295: A remote attacker could have forced unsafe YAML deserialization which could have led to code execution bsc1040151...

openSUSE: Security Advisory for rubygem-puppet (openSUSE-SU-2017:1948-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 26 : puppet (2017-b9b66117bb)

Contains fixes to ensure Puppet can start correctly and a security fix for remote code execution tracked as CVE-2017-2295. - Fix remote code execution in Puppet master during fact uploads - Fedora1452654 - Fix SSL monkey patches error on startup - Fedora1440710 , Fedora1443673 - Fix xmlrpc/client...