CVE-2016-2788 MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command.
CriticalCVSS 9.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mcollective(Debian:12) | < 2.12.0+dfsg-1 | 2.12.0+dfsg-1 |
| puppet marionette collective | = 2.7.0 | No fix listed |
| puppet marionette collective | = 2.8.0 | No fix listed |
| puppet marionette collective | = 2.8.1 | No fix listed |
| puppet marionette collective | = 2.8.2 | No fix listed |
| puppet marionette collective | = 2.8.3 | No fix listed |
| puppet marionette collective | = 2.8.4 | No fix listed |
| puppet marionette collective | = 2.8.5 | No fix listed |
| puppet marionette collective | = 2.8.6 | No fix listed |
| puppet marionette collective | = 2.8.7 | No fix listed |
| puppet marionette collective | = 2.8.8 | No fix listed |
| puppet enterprise | >= 3.8.0, < 3.8.6 | 3.8.6 |
| puppet enterprise | >= 2016.2.0, < 2016.2.1 | 2016.2.1 |
References
- Debian Security Tracker CVE-2016-2788 vendor-advisory
- puppet.com vendor-advisory
- bugs.debian.org issue-tracking