CVE-2021-27023

CVE-2021-27023 affects Puppet Agent and Puppet Server and is an information disclosure vulnerability where HTTP credentials can leak when following redirects to a different host. The description notes a flaw in how HTTP redirects are handled, similar to CVE-2018-1000007. The NVD metrics indicate ...

CVE-2023-1894

CVE-2023-1894 is a ReDoS affecting Puppet Server 7.9.2 during certificate validation. The vulnerability arises from crafted certificate names and results in significantly slowed server operations. Public details in the provided documents confirm Puppet Server as the affected component and describ...

CVE-2023-5255

CVE-2023-5255 describes a flaw in Puppet Server where certificates using the auto-renew feature cannot be revoked, per the NVD entry. The CVE notes an impact of high availability disruption (availability impact A:H) with no confidentiality or integrity impact, and no user interaction required. Th...

CVE-2020-7943

CVE-2020-7943 affects Puppet Server and PuppetDB, where the metrics API endpoints may disclose sensitive information. The issue stems from exposed metrics data (for PuppetDB: hostnames; for Puppet Server: resource names, titles, function names, and class names) when these endpoints were accessibl...

CVE-2018-11751

CVE-2018-11751 affects Puppet Agent: older versions did not verify the SSL peer when downloading the CRL. This undermines authenticity of the CRL and can impact system communications, with the cited fix in Puppet Agent 6.4.0. Remediation: upgrade to Puppet Agent 6.4.0 or later (as indicated by mu...

CVE-2016-2785

CVE-2016-2785 affects Puppet Server prior to 2.3.2, Ruby puppetmaster in Puppet 4.x prior to 4.4.2, and Puppet Agent prior to 1.4.2. The issue allows remote attackers to bypass auth.conf access restrictions by exploiting incorrect URL decoding. Affected components include Puppet Server, Puppet Ma...

CVE-2014-7170

CVE-2014-7170 describes a race condition in Puppet Server 0.2.0 that lets local users access sensitive information during the window between package installation/upgrade and the service start. The root cause is a timing window in the startup/upgrade sequence that can expose data prior to proper i...