PT-2015-5279 · Puppet · Facter

Publicado 2015-02-23 · Atualizado 2022-05-14 · CVE-2015-1426

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Puppet Labs Facter versions 1.6.0 through 2.4.0

Description The issue allows local users to obtain sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.

Recommendations For versions 1.6.0 through 2.4.0, consider restricting access to sensitive Amazon EC2 IAM instance metadata to prevent unauthorized reading of facts for Amazon EC2 nodes.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-1426

GHSA-J436-H7HM-RX46

Produtos afetados

Facter

Referências · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/facter/CVE-2015-1426.yml · Exploit
• https://github.com/puppetlabs/facter · Nota
• https://web.archive.org/web/20150906195742/http://puppetlabs.com/security/cve/cve-2015-1426 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1426 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2015-1426 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-1426 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-1426 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-1426 · Aviso do Fabricante
• https://puppet.com/security/cve/cve-2015-1426-potential-sensitive-information-leakage-facters-amazon-ec2-metadata · Nota
• http://puppetlabs.com/security/cve/cve-2015-1426 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1426 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j436-h7hm-rx46 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-1426 · Nota de Segurança