Puppet does not properly restrict access to node resources
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2011-0528US | medium5.5 | — | ||
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via un… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.mail-archive.com/puppet-users@googlegroups.com/msg16429.htmlWEB
- http://www.openwall.com/lists/oss-security/2011/01/27/6WEB
- http://www.openwall.com/lists/oss-security/2011/01/31/5WEB
- http://www.ubuntu.com/usn/USN-1365-1WEB
- https://github.com/puppetlabs/puppetPACKAGE
- https://github.com/puppetlabs/puppet/commit/eee1a9cdaa5cab6222c8e6ab087d319f976fa4e3WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2011-0528.ymlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2011-0528ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan