CVE-2016-2786

The CVE-2016-2786 entry affects the pxp-agent component in Puppet Enterprise 2015.3.x (before 2015.3.3) and Puppet Agent 1.3.x (before 1.3.6), where improper validation of server certificates may allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate. Thi...

CVE-2015-7330

Puppet Enterprise 2015.3 before 2015.3.1 is affected by CVE-2015-7330: a remote attacker can bypass the host whitelist protection mechanism by leveraging the Puppet communications protocol. The issue concerns the host-whitelist protection and is exploitable remotely via the Puppet communications ...

CVE-2015-7328

CVE-2015-7328 affects Puppet Server in Puppet Enterprise before 3.8.3 and in Puppet Server 2015.2.x before 2015.2.3. The root cause is that during initial installation and configuration the CA certificate’s private key is created with world-readable permissions, enabling local users to read sensi...