USN-1372-1: Puppet vulnerabilities

It was discovered that Puppet did not drop privileges when executing commands as different users. If an attacker had control of the execution manifests or the executed command, this could be used to execute code with elevated group permissions typically root. CVE-2012-1053 It was discovered that...

CVE-2012-1053

The changeuser method in the SUIDManager lib/puppet/util/suidmanager.rb in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors...

CVE-2012-1054

Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login...

Ubuntu Update for puppet USN-1365-1

Ubuntu Update for Linux kernel vulnerabilities USN-1365-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN13651.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for puppet USN-1365-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...

Ubuntu: Security Advisory (USN-1365-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 10.10 / 11.04 / 11.10 : Puppet vulnerability (USN-1365-1)

It was discovered that Puppet would allow remote ralsh under certain circumstances. An attacker on an authenticated puppet node could exploit this to view or manipulate resources on other Puppet nodes. Note that Tenable Network Security has extracted the preceding description block directly from...

USN-1365-1: Puppet vulnerability

It was discovered that Puppet would allow remote ralsh under certain circumstances. An attacker on an authenticated puppet node could exploit this to view or manipulate resources on other Puppet nodes...

Debian Security Advisory DSA 2352-1 (puppet)

The remote host is missing an update to puppet announced via advisory DSA 2352-1. OpenVAS Vulnerability Test $Id: deb23521.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2352-1 puppet Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Debian: Security Advisory (DSA-2352-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 11.1 Security Update : puppet (SAT Patch Number 5421)

The following security issues have been fixed : - Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks. CVE-2011-3872 Note: If you've set the...

[SECURITY] [DSA 2352-1] puppet security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2352-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 22, 2011 http://www.debian.org/security/faq -...

Puppet multiple security vulnerabilities

Multiple file overwrite vulnerabilities, certificates spooging...

Debian DSA-2352-1 : puppet - programming error

It was discovered that Puppet, a centralized configuration management solution, misgenerated certificates if the 'certdnsnames' option was used. This could lead to man in the middle attacks. More details are available on the Puppet website. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

[SECURITY] [DSA 2352-1] puppet security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2352-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 22, 2011 http://www.debian.org/security/faq -...

Fedora 16 : puppet-2.6.12-1.fc16 (2011-14880)

A bug in puppet's SSL certificate handling could allow nodes with a valid certificate to impersonate the puppet master. To be vulnerable, a user would have had to set the certdnsnames variable and generated certificates. This setting is not set by default in the Fedora/EPEL packages. This update...

DSA-2352-1 puppet - programming error

Bulletin has no description...

Fedora 14 : puppet-2.6.12-1.fc14 (2011-15000)

A bug in puppet's SSL certificate handling could allow nodes with a valid certificate to impersonate the puppet master. To be vulnerable, a user would have had to set the certdnsnames variable and generated certificates. This setting is not set by default in the Fedora/EPEL packages. This update...

Fedora 15 : puppet-2.6.12-1.fc15 (2011-14994)

A bug in puppet's SSL certificate handling could allow nodes with a valid certificate to impersonate the puppet master. To be vulnerable, a user would have had to set the certdnsnames variable and generated certificates. This setting is not set by default in the Fedora/EPEL packages. This update...

Fedora Update for puppet FEDORA-2011-15000

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for puppet FEDORA-2011-14994

Check for the Version of puppet OpenVAS Vulnerability Test Fedora Update for puppet FEDORA-2011-14994 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...