Read the docs
TI-2014-05976 Aliases CVE-2014-7170GHSA-3m28-998q-cgj7

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information…

Priority LOW 10CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

Why it matters now

EPSS 0.00227 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:puppet:puppet_server:0.2.0:*:*:*:*:*:*:*0.2.0VulnerablePuppet
  • cpe:2.3:a:puppet:puppet_server:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·Puppet

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-7170
  2. 2026-10-03 Alias added: GHSA-3m28-998q-cgj7

References

Advisory 1

  • TI-2016-02327 Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet… CVSS 3.1CRITICAL 9.8
  • TI-2021-08596 A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP… CVSS 3.1CRITICAL 9.8
  • TI-2020-06424 Incorrect default permissions in Puppet Enterprise 2018.1.x stream CVSS 3.1HIGH 7.5
  • TI-2023-04831 Denial of Service for Revocation of Auto Renewed Certificates CVSS 3.1HIGH 7.5
  • TI-2023-01780 Regular expression denial of service in Puppet Enterprise CVSS 3.1MEDIUM 5.3
  • TI-2018-08411 Improper certificate validation in Puppet Agent, Puppet CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences