CVE-2017-10690 In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included....
MediumCVSS 6.5
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| puppet | < 5.3.4 | 5.3.4 |
| puppet enterprise | < 2017.3.4 | 2017.3.4 |
| redhat satellite | = 6.4 | No fix listed |
| puppet enterprise | = 2017.3.x prior to 2017.3.4 | No fix listed |
| puppet agent | = 5.x prior to 5.3.4 | No fix listed |
References
- RHSA-2018:2927 third-party-advisory vendor-advisory
- puppet.com vendor-advisory