2385 matches found
CVE-2011-4953
The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet...
CVE-2011-4953
The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet...
CVE-2011-4953: Improper Input Validation
The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet...
Important: Red Hat Security Advisory: openstack-packstack security, bug fix, and enhancement update
Updated openstack-packstack packages that fix one security issue, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System...
Puppet Enterprise 2.8.x / 3.2.x Multiple Vulnerabilities
According to its self-reported version number, the Puppet Enterprise application installed on the remote host is version 2.8.x or 3.2.x. It is, therefore, affected by multiple vulnerabilities : - An error exists in the 'dossl3write' function that permits a NULL pointer to be dereferenced, which...
Puppet Enterprise 3.3.0 Bundled Oracle Java Vulnerabilities
According to its self-reported version number, the Puppet Enterprise application installed on the remote host is version 3.3.0. Therefore, it contains a bundled version of Oracle Java that is affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
CVE-2014-3251
The MCollective aessecurity plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to...
CVE-2014-3251
The MCollective aessecurity plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to...
CVE-2014-3251
CVE-2014-3251 affects the MCollective aes_security plugin used with Puppet Enterprise before 3.3.0 and MCollective before 2.5.3. The issue is improper validation of new server certificates based on the CA certificate, allowing a local attacker to establish unauthorized MCollective connections via...
CVE-2014-3251
The MCollective aessecurity plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to...
PT-2014-1920
Name of the Vulnerable Software and Affected Versions MCollective versions prior to 2.5.3 Puppet Enterprise versions prior to 3.3.0 Description The issue is related to the MCollective aes security plugin, which does not properly validate new server certificates based on the CA certificate. This...
CVE-2014-3251: Concurrent Execution using Shared Resource with Improper Synchronization
The MCollective aessecurity plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to...
[DLA 29-1] puppet security update
Package : puppet Version : 2.6.2-5+squeeze10 CVE ID : CVE-2012-6120 It was discovered that the puppet package did not restrict the permissions and ownership of the /var/log/puppet directory, which may expose sensitive information...
DLA-29-1 puppet - security update
Bulletin has no description...
mcollective -- cert valication issue
Melissa Stone reports: The MCollective aessecurity public key plugin does not correctly validate certs against the CA. By exploiting this vulnerability within a race/initialization window, an attacker with local access could initiate an unauthorized MCollective client connection with a server, an...
SuSE 11.3 Security Update : puppet (SAT Patch Number 9472)
Puppet was updated to fix the following security issues : - Unsafe use of temporary files. CVE-2013-4969 - Arbitrary code execution with required social engineering. CVE-2014-3248 / CVE-2014-3250 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...
Puppet < 2.7.26 / 3.6.2 and Enterprise 2.8.x < 2.8.7 Multiple Vulnerabilities
According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities : - A privilege escalation vulnerability related to input validation and paths exists in the bundled Ruby environment. An attacker could trick a privileged user into...
CVE-2014-3249
Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes...
