The vulnerability of the Puppet infrastructure automation tool and its startup application, Puppet Agent, relates to errors in the certificate validation process. This vulnerability allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Puppet infrastructure automation tool and its startup application, Puppet Agent, is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected informati...

Important: Red Hat Bug Fix Advisory: Satellite 6.7.2 Async Bug Fix Update

Updated Satellite 6.7 packages that fix several bugs are now available for Red Hat Satellite. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other clien...

SecGen

This is a Ruby application called SecGen, which creates vulnerable virtual machines for learning and practicing security penetration testing techniques. The application uses Vagrant, Puppet, and Ruby to generate randomly vulnerable virtual machines based on a scenario specification. The scenario...

CVE-2020-7943

A flaw was found where the metrics API endpoints of Puppet Server and PuppetDB leaked sensitive information to the local network. Listening to these network endpoints could allow attackers the ability to exploit additional computer systems. The highest impact of this flaw is confidentiality...

SUSE-SU-2020:1057-1 Security update for puppet

This update for puppet fixes the following issues: - CVE-2020-7942: Added a warning for a vulnerable configuration option, which could allow for information disclosure in certain setups. Disabling it my break some setups. bsc1167645...

Puppet Detection (HTTP)

Checks whether Puppet is present on the target system and if so, tries to figure out the installed version. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General...

CVE-2018-6508

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the factertask or puppetconf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this...

Continuous Delivery Information Disclosure Vulnerability

Puppet is the United States Puppet Labs a set of client/server C / S architecture based on the configuration management tools , it can be used to manage configuration files , users , cron tasks , packages , system services , etc. Continuous Delivery is used in one of the Puppet code for continuou...

CVE-2020-7944

In Continuous Delivery for Puppet Enterprise CD4PE before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive parameters ending up in the impact analysis report...

CVE-2020-7944

In Continuous Delivery for Puppet Enterprise CD4PE before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive parameters ending up in the impact analysis report...

Design/Logic Flaw

In Continuous Delivery for Puppet Enterprise CD4PE before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive parameters ending up in the impact analysis report...

CVE-2020-7944

CVE-2020-7944 affects Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0. The issue arises when changes to resources or classes containing Sensitive parameters cause those parameters to appear in the impact analysis report. The Red Hat entry confirms the same description. No explicit ...

CVE-2020-7944

In Continuous Delivery for Puppet Enterprise CD4PE before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive parameters ending up in the impact analysis report...

Information Disclosure

puppet is vulnerable to information disclosure. The entire catalog can be retrieved for a different node by modifying facts for the Puppet run when a node's catalog falls back to the default node. This vulnerability exists due to an insecure default configuration whereby the stricthostnamecheckin...

CVE-2020-7942

A flaw was found in Puppet, where changes in the application lead to node declarations having increased access. An attacker can use this flaw to modify run facts and to retrieve different nodes of information when the stricthostnamechecking is false, and the node's catalog falls back to the defau...

FreeBSD : puppet6 -- Arbitrary Catalog Retrieval (77687355-52aa-11ea-b115-643150d3111d)

Puppetlabs reports : Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the default node, the catalog c...

FreeBSD : puppetserver and puppetdb -- Puppet Server and PuppetDB may leak sensitive information via metrics API (36def7ba-6d2b-11ea-b115-643150d3111d)

Puppetlabs reports : Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types which may contain sensitive information as...

Puppet Server metrics API information disclosure vulnerability

Puppet Server is a software for pushing configurations from a master server to other servers. An information disclosure vulnerability exists in the Puppet Server metrics API, which can be exploited by a remote attacker to submit a special request and obtain sensitive information...

Puppet Enterprise Console Cross-Site Request Forgery Vulnerability

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is the enterprise version of Puppet. A cross-site request forgery...

CVE-2020-7943

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types which may contain sensitive information as well as function names...