Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-1426US | low2.1 | — | ||
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/puppetlabs/facterPACKAGE
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/facter/CVE-2015-1426.ymlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2015-1426ADVISORY
- https://web.archive.org/web/20150906195742/http://puppetlabs.com/security/cve/cve-2015-1426WEB
- https://www.puppet.com/security/cve/cve-2015-1426-potential-sensitive-information-leakage-facters-amazon-ec2-metadataWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan