PT-2017-10263 · Puppet · Puppet Enterprise

Publicado 2017-02-08 · Atualizado 2019-07-10 · CVE-2016-9686

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2016.4.3 Puppet Enterprise versions prior to 2016.5.2

Description The issue concerns the incorrect validation of message header sizes in the Puppet Communications Protocol (PCP) Broker. This could allow an attacker to crash the PCP Broker, which would prevent commands from being sent to agents.

Recommendations For versions prior to 2016.4.3, update to version 2016.4.3 to resolve the issue. For versions prior to 2016.5.2, update to version 2016.5.2 to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-9686

Produtos afetados

Puppet Enterprise

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-9686 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9686 · Aviso do Fabricante
• https://puppet.com/security/cve/cve-2016-9686 · Aviso do Fabricante