CVE-2011-3871

Removed by vendor...

CVE-2011-3869

Removed by vendor...

PT-2011-1168

Name of the Vulnerable Software and Affected Versions Puppet versions 2.6.x through 2.6.9 Puppet versions 2.7.x through 2.7.3 Description The issue allows remote attackers to write X.509 Certificate Signing Request CSR to arbitrary locations. This can be achieved via a double-encoded key paramete...

PT-2011-1169

Name of the Vulnerable Software and Affected Versions Puppet versions 2.7.x through 2.7.4 Puppet versions 2.6.x through 2.6.10 Puppet versions 0.25.x Description The issue allows local users to overwrite arbitrary files via a symlink attack on the .k5login file, potentially leading to disruption ...

PT-2011-1170

Name of the Vulnerable Software and Affected Versions Puppet versions 2.7.x through 2.7.4 Puppet versions 2.6.x through 2.6.10 Puppet versions 0.25.x Description The issue allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized keys file. Multipl...

CVE-2011-3872: Improper Input Validation

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise PE Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof ...

CVE-2011-3848: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request CSR to arbitrary locations via 1 a double-encoded key parameter in the URI in 2.7.x, 2 the CN in the Subject of a CSR in 2.6 and 0.25...

CVE-2011-3869: Improper Link Resolution Before File Access

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file...

CVE-2011-3870: Improper Link Resolution Before File Access

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorizedkeys file...

Puppet uses predictable filenames, allowing arbitrary file overwrite

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...

Puppet allows local users to modify the permissions of arbitrary files

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorizedkeys file...

CVE-2011-3871: Undefined Security Weakness

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...

PT-2011-1171

Name of the Vulnerable Software and Affected Versions Puppet versions 2.7.x prior to 2.7.5 Puppet versions 2.6.x prior to 2.6.11 Puppet version 0.25.x Description The issue allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files due to the use of a predictable...

PT-2011-1172

Name of the Vulnerable Software and Affected Versions Puppet versions 2.6.x through 2.6.11 Puppet versions 2.7.x through 2.7.5 Puppet Enterprise PE Users versions 1.0 through 1.2.3 Description The issue allows remote attackers to spoof a Puppet master via a man-in-the-middle MITM attack against a...

Ubuntu 11.04 : puppet regression (USN-1238-2)

USN-1238-1 fixed vulnerabilities in Puppet. The upstream patch introduced a regression in Ubuntu 11.04 when executing certain commands. This update fixes the problem. We apologize for the inconvenience. It was discovered that Puppet incorrectly handled the non-default 'certdnsnames' option when...

USN-1238-2: Puppet regression

USN-1238-1 fixed vulnerabilities in Puppet. The upstream patch introduced a regression in Ubuntu 11.04 when executing certain commands. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Puppet incorrectly handled the non-default...

Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : puppet vulnerability (USN-1238-1)

It was discovered that Puppet incorrectly handled the non-default 'certdnsnames' option when generating certificates. If this setting was added to puppet.conf, the puppet master's DNS alt names were added to the X.509 Subject Alternative Name field of all certificates, not just the puppet master'...

USN-1238-1: Puppet vulnerability

It was discovered that Puppet incorrectly handled the non-default "certdnsnames" option when generating certificates. If this setting was added to puppet.conf, the puppet primary server’s DNS alt names were added to the X.509 Subject Alternative Name field of all certificates, not just the puppet...

CVE-2011-3872

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise PE Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof ...

Fedora Update for puppet FEDORA-2011-13633

Check for the Version of puppet OpenVAS Vulnerability Test Fedora Update for puppet FEDORA-2011-13633 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...