CVE-2013-1640

Removed by vendor...

CVE-2013-1655

Removed by vendor...

CVE-2013-1654

Removed by vendor...

CVE-2013-1652

CVE-2013-1652 affects Puppet: remote authenticated users with a valid certificate and key can read arbitrary catalogs or poison the Puppet master’s cache via unspecified vectors. Affected versions include Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, plus Puppet Enterprise be...

CVE-2013-2274

Removed by vendor...

CVE-2013-1652

Removed by vendor...

CVE-2013-1653

Removed by vendor...

CVE-2013-1654

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors...

CVE-2013-1654

CVE-2013-1654 affects Puppet 2.7.x prior to 2.7.21, Puppet 3.1.x prior to 3.1.1, and Puppet Enterprise 2.7.x prior to 2.7.2. The issue arises from how SSL protocol negotiation occurs between client and master, enabling remote attackers to perform SSLv2 downgrade attacks against SSLv3 sessions via...

CVE-2013-2275

CVE-2013-2275 affects Puppet components where the default /etc/puppet/auth.conf allowed an authenticated node to submit a report for another node. Affected: Puppet masters 0.25.0+ and Puppet versions 2.x (before 2.6.18 for 2.6 line, before 2.7.21 for 2.7 line), 3.1.x before 3.1.1, and Puppet Ente...

CVE-2013-2274

Puppet vulnerability CVE-2013-2274 affects Puppet 2.6.x (pre-2.6.18) and Puppet Enterprise 1.2.x (pre-1.2.7). An authenticated attacker could send a crafted report to the puppet master (or an agent with puppet kick enabled) to achieve remote arbitrary code execution. Remediation per RHSA-2013:071...

CVE-2013-1640

CVE-2013-1640 affects Puppet master handling of template and inline_template functions. The flaw allows remote authenticated users to execute arbitrary code via a crafted catalog request. Affected versions include Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, as well as Puppe...

CVE-2013-1653

CVE-2013-1653 affects Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1 (and Puppet Enterprise before 1.2.7 / 2.7.x before 2.7.2) when the service is listening for incoming connections and the run REST endpoint is accessible. It allows remote authenticated users to execute arbitra...

CVE-2013-2275

Removed by vendor...

CVE-2013-2274: Undefined Security Weakness

Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report...

CVE-2013-1652: Undefined Security Weakness

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors...

CVE-2013-1653: Undefined Security Weakness

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code v...

CVE-2013-1655: Improper Input Validation

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."...

CVE-2013-2275: Undefined Security Weakness

The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors...

CVE-2013-1640: Undefined Security Weakness

The 1 template and 2 inlinetemplate functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request...