2015 matches found
Puppet Labs Puppet Enterprise Server Detection
Binary data 6881.prm...
Ubuntu Update for puppet USN-1886-1
Check for the Version of puppet OpenVAS Vulnerability Test $Id: gbubuntuUSN18861.nasl 7958 2017-12-01 06:47:47Z santu $ Ubuntu Update for puppet USN-1886-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software;...
Ubuntu: Security Advisory (USN-1886-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
FreeBSD : puppet -- Unauthenticated Remote Code Execution Vulnerability (b162b218-c547-4ba2-ae31-6fdcb61bc763)
Puppet Developers report : When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby...
Ubuntu 12.04 LTS / 12.10 / 13.04 : puppet vulnerability (USN-1886-1)
It was discovered that Puppet incorrectly handled YAML payloads. An attacker on an untrusted client could use this issue to execute arbitrary code on the master. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable ha...
USN-1886-1: Puppet vulnerability
It was discovered that Puppet incorrectly handled YAML payloads. An attacker on an untrusted client could use this issue to execute arbitrary code on the primary server...
CVE-2013-3567
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...
puppet -- Unauthenticated Remote Code Execution Vulnerability
Puppet Developers report: When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby...
Puppet Multiple Vulnerabilities (2013/03/12)
According to its self-reported version number, the version of Puppet Open Source or Puppet Enterprise running on the remote host has the following vulnerabilities : - A vulnerability that allows an authenticated client to execute arbitrary code on a puppet master. CVE-2013-1640 - A vulnerability...
Puppet REST API Detection
A Puppet REST API web service, used for communication between masters and agents, was detected on the remote host C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66233; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24";...
Puppet Enterprise Console Authentication Bypass (intrusive check)
The version of Puppet Enterprise Console running on the remote host has an authentication bypass vulnerability. The secret value used to prevent cookie tampering is not random. This allows a remote, unauthenticated attacker to create a cookie that would be inappropriately authorized by the consol...
Puppet Enterprise Console Detection
Puppet Enterprise Console, a web management interface for Puppet Enterprise, was detected on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66234; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"Puppet Enterprise Console...
Puppet Unsafe YAML Unserialization
According to its self-reported version number, the Puppet install on the remote host has a remote code execution vulnerability. Specially crafted YAML encoded objects are not unserialized safely. A remote, unauthenticated attacker could exploit this to execute arbitrary code. The issue is...
Medium: puppet
Issue Overview: The 1 template and 2 inlinetemplate functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog...
CVE-2013-2716
Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file casclientconfig.yml when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie...
CVE-2012-6120
Red Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable permissions, which allows local users to obtain sensitive information such as Puppet log files...
CVE-2012-6120
Red Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable permissions, which allows local users to obtain sensitive information such as Puppet log files...
DEBIAN-CVE-2012-6120
Red Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable permissions, which allows local users to obtain sensitive information such as Puppet log files...
Code injection
Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file casclientconfig.yml when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie...