Puppet

Records130All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical19CVSS 9.0–10.0

CVSS high30CVSS 7.0–8.9

Exploited now

Puppet records in CISA KEV

No Puppet vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Puppet Enterprise 89 records HIGH Puppet 42 records MEDIUM Puppet Agent 8 records MEDIUM Puppet Server 7 records MEDIUM Continuous Delivery 4 records LOW Marionette Collective 3 records MEDIUM Puppetdb 3 records MEDIUM Puppetlabs-mysql 3 records MEDIUM

Records

7 records in Puppet Server · all components

TI-2016-02327 CVE-2016-2785 · GHSA-pqj5-7r86-64fv

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet…

MEDIUM 47

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decod…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02889 Published 2016-06-10 Partial fix · 4.4.2 CWE-284

TI-2021-08596 CVE-2021-27023 · GHSA-93j5-g845-9wqp

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP…

MEDIUM 45

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01372 Published 2021-11-18 Fixed in 7.12.1, 6.25.1

TI-2020-06424 CVE-2020-7943 · GHSA-xv72-7w5r-cqjw

Incorrect default permissions in Puppet Enterprise 2018.1.x stream

MEDIUM 43

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07674 Published 2020-03-11 Fixed in 2018.1.13, 2019.5.0 +4 CWE-276

TI-2023-04831 CVE-2023-5255 · GHSA-q3vx-5wxp-g986

Denial of Service for Revocation of Auto Renewed Certificates

LOW 33

For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00476 Published 2023-10-03 No fix listed CWE-404

TI-2023-01780 CVE-2023-1894 · GHSA-x5cv-mqxq-8q96

Regular expression denial of service in Puppet Enterprise

LOW 30

A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00437 Published 2023-05-04 Fixed in 2021.7.3, 2023.1.0 +2 CWE-1333

TI-2018-08411 CVE-2018-11751 · GHSA-vvrg-mw82-38g2

Improper certificate validation in Puppet Agent, Puppet

LOW 25

Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL.

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.00608 Published 2019-12-16 Partial fix CWE-295

TI-2014-05976 CVE-2014-7170 · GHSA-3m28-998q-cgj7

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information…

LOW 10

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVSS 2.0LOW 1.9 Local No auth Interaction — EPSS 0.00227 Published 2014-12-17 No fix listed CWE-362

Open these records in search →

Critical	19
High	30
Medium	67
Low	14
No CVSS	0