Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: Puppet Component: Puppet Server Clear all filters
TI-2023-04831 CVE-2023-5255 · GHSA-q3vx-5wxp-g986

Denial of Service for Revocation of Auto Renewed Certificates

Priority LOW 33

For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00476 Published 2023-10-03 No fix listed CWE-404
TI-2023-01780 CVE-2023-1894 · GHSA-x5cv-mqxq-8q96

Regular expression denial of service in Puppet Enterprise

Priority LOW 30

A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00437 Published 2023-05-04 Fixed in 2021.7.3, 2023.1.0 +2 CWE-1333
TI-2018-08411 CVE-2018-11751 · GHSA-vvrg-mw82-38g2

Improper certificate validation in Puppet Agent, Puppet

Priority LOW 25

Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL.

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.00608 Published 2019-12-16 Partial fix CWE-295
TI-2016-02327 CVE-2016-2785 · GHSA-pqj5-7r86-64fv

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet…

Priority MEDIUM 47

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decod…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02889 Published 2016-06-10 Partial fix · 4.4.2 CWE-284