202 matches found
CVE-2016-5713
Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...
CVE-2016-5713
Removed by vendor...
CVE-2016-5713: Improper Control of Generation of Code
Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...
Puppet Enterprise and Puppet Agent Code Execution Vulnerabilities
Puppet Enterprise and Puppet Agent are both products of Puppet Labs, Inc. Puppet is a set of configuration management tools based on the client/server C/S architecture of Puppet Labs, Inc. and Puppet Enterprise is an enterprise version; Puppet Agent is a set of client-side Puppet Agent is a set o...
CVE-2016-5714
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol PXP Command...
CVE-2016-5714
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol PXP Command...
DEBIAN-CVE-2016-5714
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol PXP Command...
CVE-2016-5714
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol PXP Command...
CVE-2016-5714
CVE-2016-5714 affects Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0. The vulnerability allows remote attackers to bypass the host whitelist protection and execute arbitrary code on Puppet nodes, via issues in the Puppet Execution Protocol (PXP) Comman...
CVE-2016-5714: Improper Access Control
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol PXP Command...
GLSA-201710-12 : Puppet Agent: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201710-12 Puppet Agent: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Puppet Agent. Please review the references for details. Impact : A remote attacker could possibly execute arbitrary code with the...
Puppet Agent: Multiple vulnerabilities
Background Puppet Agent contains Puppet’s main code and all of the dependencies needed to run it, including Facter, Hiera, and bundled versions of Ruby and OpenSSL. Description Multiple vulnerabilities have been discovered in Puppet Agent. Please review the references for details. Impact A remote...
mcollective-puppet-agent elevation of privilege vulnerability
Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the United States, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. mcollective-puppet-agent is a framework used to run agents in Puppet...
CVE-2017-2290
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-age...
CVE-2017-2290
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-age...
Design/Logic Flaw
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-age...
CVE-2017-2290
On Windows installations of the mcollective-puppet-agent plugin (version 1.12.0), a non-administrator can place an executable that will run with administrator privileges on the next mco puppet run. Puppet Enterprise users are not affected. The issue is resolved in mcollective-puppet-agent 1.12.1....
CVE-2017-2290
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-age...
CVE-2017-2290: Incorrect Permission Assignment for Critical Resource
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-age...