PT-2013-1232 · Puppet+2 · Puppet+3

Publicado 2013-03-20 · Atualizado 2019-07-10 · CVE-2013-2275

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Puppet versions prior to 2.7.23 Puppet versions 0.25.0 through 2.6.18 Puppet versions 2.7.x through 2.7.20 Puppet versions 3.1.x through 3.1.0 Puppet Enterprise versions prior to 1.2.7 Puppet Enterprise versions 2.7.x through 2.7.1

Description The issue affects the puppet package in Gentoo Linux and allows remote authenticated attackers to exploit multiple vulnerabilities, potentially leading to breaches of confidentiality, integrity, and availability of protected information. The default configuration of puppet masters enables remote authenticated nodes to submit reports for other nodes via unspecified vectors.

Recommendations For Puppet versions prior to 2.7.23, update to version 2.7.23 or later. For Puppet versions 0.25.0 through 2.6.18, update to version 2.6.18 or later. For Puppet versions 2.7.x through 2.7.20, update to version 2.7.21 or later. For Puppet versions 3.1.x through 3.1.0, update to version 3.1.1 or later. For Puppet Enterprise versions prior to 1.2.7, update to version 1.2.7 or later. For Puppet Enterprise versions 2.7.x through 2.7.1, update to version 2.7.2 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-09724

CVE-2013-2275

DSA-2643-1

RHSA-2013:0710

Produtos afetados

Gentoo Linux

Puppet

Puppet Enterprise

Suse

Referências · 14

• http://rhn.redhat.com/errata/RHSA-2013-0710.html · Aviso do Fabricante
• https://puppetlabs.com/security/cve/cve-2013-2275 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html · Aviso do Fabricante
• http://securityfocus.com/bid/58449 · Nota
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html · Aviso do Fabricante
• http://secunia.com/advisories/52596 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2275 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-201308-04.xml · Nota
• http://debian.org/security/2013/dsa-2643 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09724 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2275 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-2275 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-2275 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1759-1 · Aviso do Fabricante