TI-2018-04789 Aliases CVE-2018-6508 GHSA-j433-wpfx-cxg3

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug…

LOW 39CWE-134Published 2018-02-09 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-134 and the CVSS impact.

Summary

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.

Why it matters now

EPSS 0.01871 79th percentileScored 2026-11-07

Fix Partial Puppet Enterprise (Puppet): 2017.3.4puppetlabs/facter_task (Puppet): 0.1.5+4 more productsRed Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Puppet	Puppet Enterprise	2017.3 to before 2017.3.4	2017.3.4	Patch available	CNA
Puppet	puppetlabs/facter_task	before 0.1.5	0.1.5	Patch available	CNA
Puppet	puppetlabs/puppet_conf	before 0.1.5	0.1.5	Patch available	CNA
Puppet	puppetlabs/apt	before 4.5.1	4.5.1	Patch available	CNA
Puppet	puppetlabs/mysql	before 5.2.1	5.2.1	Patch available	CNA
Puppet	puppetlabs/apache	before 2.3.1	2.3.1	Patch available	CNA

Puppet Enterprise VendorPuppet Affected 2017.3 to before 2017.3.4 Fixed in 2017.3.4 Patch available CNA
puppetlabs/facter_task VendorPuppet Affected before 0.1.5 Fixed in 0.1.5 Patch available CNA
puppetlabs/puppet_conf VendorPuppet Affected before 0.1.5 Fixed in 0.1.5 Patch available CNA
puppetlabs/apt VendorPuppet Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
puppetlabs/mysql VendorPuppet Affected before 5.2.1 Fixed in 5.2.1 Patch available CNA
puppetlabs/apache VendorPuppet Affected before 2.3.1 Fixed in 2.3.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:puppet:puppet_enterprise::::::::	2017.3.0 – 2017.3.2	Vulnerable	Puppet

cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:* Versions 2017.3.0 – 2017.3.2 Vulnerable ·Puppet

Remediation

Fix · CNA Puppet Enterprise (Puppet) Fixed in 2017.3.4
Fix · CNA puppetlabs/facter_task (Puppet) Fixed in 0.1.5
Fix · CNA puppetlabs/puppet_conf (Puppet) Fixed in 0.1.5
Fix · CNA puppetlabs/apt (Puppet) Fixed in 4.5.1
Fix · CNA puppetlabs/mysql (Puppet) Fixed in 5.2.1
Fix · CNA puppetlabs/apache (Puppet) Fixed in 2.3.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix yet

Not affected: 3 products

Red Hat OpenStack Platform 10 (Newton)
Red Hat OpenStack Platform 11 (Ocata)
Red Hat OpenStack Platform 12 (Pike)

Timeline

2026-10-02 Threatist record created from CVE-2018-6508
2026-10-03 Alias added: GHSA-j433-wpfx-cxg3

References

Advisory 1

https://puppet.com/security/cve/CVE-2018-6508

TI-2017-05170 Integer overflow in nginx CVSS 3.1HIGH 7.5
TI-2023-02371 A privilege escalation allowing remote code execution was discovered in the orchestration service. CVSS 3.1CRITICAL 9.8
TI-2013-01442 The (1) template and (2) inline_template functions in the master server in Puppet before… CVSS 2.0HIGH 9.0
TI-2018-04792 Code injection in Puppet Enterprise 2018.1.x prior to 2018.1.1, razor-server and… CVSS 3.0CRITICAL 9.8
TI-2016-02330 MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote… CVSS 3.0CRITICAL 9.8
TI-2021-08596 A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP… CVSS 3.1CRITICAL 9.8

See all 88 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences