CVE-2016-5714 Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet....
HighCVSS 7.2
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/puppet(Debian:11) | < 4.8.0-1 | 4.8.0-1 |
| puppet enterprise | = 2015.3.3 | No fix listed |
| puppet enterprise | = 2016.1.1 | No fix listed |
| puppet enterprise | = 2016.1.2 | No fix listed |
| puppet enterprise | = 2016.2.0 | No fix listed |
| puppet enterprise | = 2016.2.1 | No fix listed |
| puppet agent | >= 1.3.6, <= 1.7.0 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- bugs.gentoo.org issue-tracking third-party-advisory
- puppet.com vendor-advisory
- puppet.com issue-tracking vendor-advisory
- GLSA-201710-12 third-party-advisory vendor-advisory