CVE-2011-0528 Puppet does not properly restrict access to node resources
MediumCVSS 5.5
EPSS 1.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | >= 2.6.0, <= 2.6.3 | No fix listed |
| rubygems puppet(RubyGems) | >= 2.6.0, < 2.6.4 | 2.6.4 |
| rubygems puppet(RubyGems) | = 2.6.0 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.2 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.3 | No fix listed |
| debian/puppet(Debian:11) | < 2.6.2-3 | 2.6.2-3 |
| puppet | = 2.6.0 | No fix listed |
| puppet | = 2.6.1 | No fix listed |
| puppet | = 2.6.2 | No fix listed |
| puppet | = 2.6.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [oss-security] 20110127 CVE request: puppet mailing-list
- [oss-security] 20110127 Re: CVE request: puppet mailing-list
- USN-1365-1 vendor-advisory
- github.com patch
- github.com exploit
- www.mail-archive.com
- github.com
- github.com product
- security-tracker.debian.org vendor-advisory
- [puppet-users] 20101201 SECURITY: Authorization vulnerability in Puppet 2.6.x mailing-list