2015 matches found
Puppet Agent < 6.25.1 / 7.x < 7.12.1 Vulnerability
A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first pluginsync. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
Puppet Enterprise 2021.x < 2021.0 / 2023.x < 2023.2 RCE
A privilege escalation allowing remote code execution was discovered in the orchestration service. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugin...
Puppet Agent 6.x < 6.22.1 / 7.x < 7.6.1 Vulnerability
On February 16, 2021, OpenSSL published security updates addressing CVE-2021-23841, CVE-2021-23839, and CVE-2021-23840. Previous releases of Puppet Agent contain a vulnerable version of OpenSSL. For more information about this vulnerability, refer to the OpenSSL security announcement. Note that...
Puppet Enterprise < 2019.8.8 / 2021.3.0 Information Disclosure Vulnerability
A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes inventory service nodes. Note that Nessus has not tested for this issue but has instead...
Puppet Agent 6.x < 6.23.0 / 7.x < 7.8.0 Multiple Vulnerabilities
On May 26, 2021 curl published security updates addressing 3 CVEs: CVE-2021-22897 Low CVE-2021-22898 Medium CVE-2021-22901 High. Previous releases of Puppet Agent contain this vulnerable version of curl. For more information about this vulnerability, refer to the curl ecurity announcements. Note...
Puppet Enterprise < 2019.8.7 / 2021.x < 2021.2 Curl Vulnerabilities
For more information about this vulnerability, refer to the security announcements. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugin were extracted...
Puppet Enterprise < 2019.8.6 Unsantized Input Vulnerability
Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugin...
Puppet Enterprise < 2018.1.17 / 2019.x < 2019.8.3 Curl Vulnerability
Previous releases of Puppet Enterprise contain a vulnerable version of curl. For more information about this vulnerability, refer to the security announcement for CVE-2020-8231. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
Puppet Enterprise < 2018.1.17 / 2019.x < 2019.8.3 PostgreSQL Vulnerabilities
For more information about the vulnerabilities, refer to the Postgresql News Page. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugin were extracted...
Puppet Enterprise < 2019.8.8 / 2021.x < 2021.3 PostgreSQL Vulnerability
For more information about this vulnerability, refer to the security announcements for CVE-2021-3677 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugi...
Puppet Enterprise < 2018.1.18 / 2019.x < 2019.8.4 PostgreSQL Vulnerabilities
For more information about the vulnerabilities, refer to the Postgresql News Page. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugin were extracted...
Puppet Agent < 7.1.0 Vulnerability
Puppet Agent prior to 7.1.0 contain a vulnerable version of OpenSSL. For more information about this vulnerability, refer to the OpenSSL security announcement for CVE-2020-1971. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
Puppet Agent 6.x < 6.22.1 / 7.x < 7.6.1. Vulnerability
On March 25, 2021, OpenSSL published security updates addressing CVE-2021-3450 and CVE-2021-3449. Previous releases of Puppet Agent contain a vulnerable version of OpenSSL. For more information about this vulnerability, refer to the OpenSSL security announcement:...
Ubuntu 16.04 ESM : Puppet vulnerabilities (USN-4804-1)
The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4804-1 advisory. It was discovered that Puppet installed modules with world writable permissions. An attacker could use this vulnerability to execute arbitrary code or...
SUSE CVE-2023-5255
For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked...
Puppet Bolt privilege escalation vulnerability
In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified...
GHSA-289M-2964-F8Q5 Puppet Bolt privilege escalation vulnerability
In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified...
CVE-2023-5214
In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified...
