CVE-2013-1653

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code v...

CVE-2013-1652

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors...

CVE-2013-1654

CVE-2013-1654 affects Puppet 2.7.x prior to 2.7.21, Puppet 3.1.x prior to 3.1.1, and Puppet Enterprise 2.7.x prior to 2.7.2. The issue arises from how SSL protocol negotiation occurs between client and master, enabling remote attackers to perform SSLv2 downgrade attacks against SSLv3 sessions via...

CVE-2013-1654

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors...

CVE-2013-2274

Puppet vulnerability CVE-2013-2274 affects Puppet 2.6.x (pre-2.6.18) and Puppet Enterprise 1.2.x (pre-1.2.7). An authenticated attacker could send a crafted report to the puppet master (or an agent with puppet kick enabled) to achieve remote arbitrary code execution. Remediation per RHSA-2013:071...

CVE-2013-1653

CVE-2013-1653 affects Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1 (and Puppet Enterprise before 1.2.7 / 2.7.x before 2.7.2) when the service is listening for incoming connections and the run REST endpoint is accessible. It allows remote authenticated users to execute arbitra...

CVE-2013-2275

CVE-2013-2275 affects Puppet components where the default /etc/puppet/auth.conf allowed an authenticated node to submit a report for another node. Affected: Puppet masters 0.25.0+ and Puppet versions 2.x (before 2.6.18 for 2.6 line, before 2.7.21 for 2.7 line), 3.1.x before 3.1.1, and Puppet Ente...

CVE-2013-1640

CVE-2013-1640 affects Puppet master handling of template and inline_template functions. The flaw allows remote authenticated users to execute arbitrary code via a crafted catalog request. Affected versions include Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, as well as Puppe...

CVE-2013-2275

The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors...

Ubuntu Update for puppet USN-1759-1

Check for the Version of puppet OpenVAS Vulnerability Test $Id: gbubuntuUSN17591.nasl 8650 2018-02-03 12:16:59Z teissa $ Ubuntu Update for puppet USN-1759-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software;...

Ubuntu: Security Advisory (USN-1759-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : puppet27 and puppet -- multiple vulnerabilities (cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c)

Moses Mendoza reports : A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or...

Debian DSA-2643-1 : puppet - several vulnerabilities

Multiple vulnerabilities were discovered in Puppet, a centralized configuration management system. - CVE-2013-1640 An authenticated malicious client may request its catalog from the puppet master, and cause the puppet master to execute arbitrary code. The puppet master must be made to invoke the...

puppet26 -- multiple vulnerabilities

Moses Mendoza reports: A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or...

puppet27 and puppet -- multiple vulnerabilities

Moses Mendoza reports: A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or...

Ubuntu 11.10 / 12.04 LTS / 12.10 : puppet vulnerabilities (USN-1759-1)

It was discovered that Puppet agents incorrectly handled certain kick connections in a non-default configuration. An attacker on an authenticated client could use this issue to possibly execute arbitrary code. CVE-2013-1653 It was discovered that Puppet incorrectly handled certain catalog request...

[SECURITY] [DSA 2643-1] puppet security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2643-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 12, 2013 http://www.debian.org/security/faq -...

USN-1759-1: Puppet vulnerabilities

It was discovered that Puppet agents incorrectly handled certain kick connections in a non-default configuration. An attacker on an authenticated client could use this issue to possibly execute arbitrary code. CVE-2013-1653 It was discovered that Puppet incorrectly handled certain catalog request...

CVE-2013-2274

Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report...

CVE-2013-2275

The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors...