TI-2016-07865 Aliases CVE-2016-9686 GHSA-9pfr-f5q4-v4v8

Improper input validation in Puppet Enterprise

LOW 27CWE-20Published 2017-02-08 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2.

Why it matters now

EPSS 0.01275 70th percentileScored 2026-11-07

Fix Fixed Puppet Enterprise (Puppet): 2016.4.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Puppet	Puppet Enterprise	2015.3.x; 2016 to before 2016.4.3; 2016.5.1.	2016.4.3	Patch available	CNA

Puppet Enterprise VendorPuppet Affected 2015.3.x; 2016 to before 2016.4.3; 2016.5.1. Fixed in 2016.4.3 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:puppet:puppet_enterprise::::::::	2016.4.0 to before 2016.4.3	Vulnerable	Puppet
cpe:2.3:a:puppet:puppet_enterprise:2016.5.1:::::::*	2016.5.1	Vulnerable	Puppet

cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:* Versions 2016.4.0 to before 2016.4.3 Vulnerable ·Puppet
cpe:2.3:a:puppet:puppet_enterprise:2016.5.1:*:*:*:*:*:*:* Versions 2016.5.1 Vulnerable ·Puppet

Remediation

Fix · CNA Puppet Enterprise (Puppet) Fixed in 2016.4.3

Timeline

2026-10-02 Threatist record created from CVE-2016-9686
2026-10-03 Alias added: GHSA-9pfr-f5q4-v4v8

References

Advisory 1

https://puppet.com/security/cve/cve-2016-9686

TI-2017-05170 Integer overflow in nginx CVSS 3.1HIGH 7.5
TI-2023-02371 A privilege escalation allowing remote code execution was discovered in the orchestration service. CVSS 3.1CRITICAL 9.8
TI-2013-01442 The (1) template and (2) inline_template functions in the master server in Puppet before… CVSS 2.0HIGH 9.0
TI-2018-04792 Code injection in Puppet Enterprise 2018.1.x prior to 2018.1.1, razor-server and… CVSS 3.0CRITICAL 9.8
TI-2016-02330 MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote… CVSS 3.0CRITICAL 9.8
TI-2021-08596 A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP… CVSS 3.1CRITICAL 9.8

See all 88 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences