Command injection

The Puppet Communications Protocol PCP Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2...

CVE-2016-9686

The Puppet Communications Protocol PCP Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2...

CVE-2016-9686

CVE-2016-9686 affects the Puppet Communications Protocol (PCP) Broker in Puppet Enterprise. The root cause is incorrect validation of message header sizes, allowing an attacker to crash the PCP Broker and prevent commands from reaching agents, resulting in a partial availability impact. The vulne...

CVE-2016-9686

The Puppet Communications Protocol PCP Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2...

CVE-2016-9686

Removed by vendor...

PT-2017-10263

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2016.4.3 Puppet Enterprise versions prior to 2016.5.2 Description The issue concerns the incorrect validation of message header sizes in the Puppet Communications Protocol PCP Broker. This could allow an...

CVE-2016-9686: Improper Input Validation

The Puppet Communications Protocol PCP Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2...

Code injection

The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument...

CVE-2015-7331

The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument...

CVE-2015-7331

The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument...

CVE-2015-7331

The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument...

CVE-2015-7331

CVE-2015-7331 affects the mcollective-puppet-agent plugin prior to 1.11.1 for Puppet, allowing remote code execution via the --server argument. The vulnerability enables an unauthenticated, remote attacker to execute arbitrary code in the context of the affected application. Supporting documents ...

CVE-2015-7331

The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument...

CVE-2015-7331

Removed by vendor...

CVE-2015-7331: Undefined Security Weakness

The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --server argument...

PT-2017-7194

Name of the Vulnerable Software and Affected Versions mcollective-puppet-agent plugin versions prior to 1.11.1 Description The issue allows remote attackers to execute arbitrary code. This is achieved through vectors involving the --server argument. Recommendations For versions prior to 1.11.1,...

Moderate: Red Hat Security Advisory: puppet-swift security update

An update for puppet-swift is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Man-in-the-Middle (MitM)

puppet is vulnerable to man-in-the-middle MitM attacks. The rubygems source is deprecated because HTTP requests are insecure. A malicious user can potentially compromise the source to conduct MitM attacks...

Open redirect

Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // slash slash followed by a domain in the redirect parameter. NOTE: this vulnerability exists...

CVE-2016-5715

Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // slash slash followed by a domain in the redirect parameter. NOTE: this vulnerability exists...