CVE-2018-6508 Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affe...
HighCVSS 8.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/puppet-module-puppetlabs-apache(Debian:12) | < 3.0.0-1 | 3.0.0-1 |
| debian/puppet-module-puppetlabs-apache(Debian:13) | < 3.0.0-1 | 3.0.0-1 |
| debian/puppet-module-puppetlabs-apt(Debian:12) | < 4.5.1-1 | 4.5.1-1 |
| debian/puppet-module-puppetlabs-apt(Debian:13) | < 4.5.1-1 | 4.5.1-1 |
| debian/puppet-module-puppetlabs-apt(Debian:14) | < 4.5.1-1 | 4.5.1-1 |
| debian/puppet-module-puppetlabs-mysql(Debian:12) | < 5.3.0-1 | 5.3.0-1 |
| debian/puppet-module-puppetlabs-mysql(Debian:13) | < 5.3.0-1 | 5.3.0-1 |
| debian/puppet-module-puppetlabs-mysql(Debian:14) | < 5.3.0-1 | 5.3.0-1 |
| puppet enterprise | >= 2017.3.0, <= 2017.3.2 | No fix listed |
| ubuntu/puppet-module-puppetlabs-apache(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/puppet-module-puppetlabs-apt(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/puppet-module-puppetlabs-mysql(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/puppet-module-puppetlabs-apache(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/puppet-module-puppetlabs-apt(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/puppet-module-puppetlabs-mysql(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/puppet-module-puppetlabs-apache(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/puppet-module-puppetlabs-apt(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/puppet-module-puppetlabs-mysql(Ubuntu:26.10) | All versions | No fix listed |
| puppet enterprise | = 2017.3.x prior to 2017.3.4 | No fix listed |
| puppetlabs/facter_task | = prior to 0.1.5 | No fix listed |
| puppetlabs/puppet_conf | = prior to 0.1.5 | No fix listed |
| puppetlabs/apt | = prior to 4.5.1 | No fix listed |
| puppetlabs/mysql | = prior to 5.2.1 | No fix listed |
| puppetlabs/apache | = prior to 2.3.1 | No fix listed |
| ubuntu/puppet-module-puppetlabs-apache(Ubuntu:22.04) | All versions | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/puppet-module-puppetlabs-apt(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/puppet-module-puppetlabs-mysql(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-6508 vendor-advisory
- 103020 third-party-advisory vdb-entry
- puppet.com vendor-advisory