UbuntuUSN-3308-1Puppet vulnerabilities
8.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
7.9 High
AI Score
Confidence
High
6.2 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:H/Au:N/C:C/I:C/A:C
0.002 Low
EPSS
Percentile
64.0%
Releases
- Ubuntu 14.04 ESM
Packages
- puppet - Centralized configuration management
Details
Dennis Rowe discovered that Puppet incorrectly handled the search path. A
local attacker could use this issue to possibly execute arbitrary code.
(CVE-2014-3248)
It was discovered that Puppet incorrectly handled YAML deserialization. A
remote attacker could possibly use this issue to execute arbitrary code on
the master. This update is incompatible with agents older than 3.2.2.
(CVE-2017-2295)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 14.04 | noarch | puppet-common | < 3.4.3-1ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | puppet | < 3.4.3-1ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | puppet-el | < 3.4.3-1ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | puppet-testsuite | < 3.4.3-1ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | puppetmaster | < 3.4.3-1ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | puppetmaster-common | < 3.4.3-1ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | puppetmaster-passenger | < 3.4.3-1ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | vim-puppet | < 3.4.3-1ubuntu1.2 | UNKNOWN |
Related
8.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
7.9 High
AI Score
Confidence
High
6.2 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:H/Au:N/C:C/I:C/A:C
0.002 Low
EPSS
Percentile
64.0%