PT-2017-8260 · Puppet · Puppet Enterprise

Publicado 2017-02-13 · Atualizado 2019-07-10 · CVE-2016-2787

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2015.3.x through 2015.3.2

Description The issue is related to the Puppet Communications Protocol, which does not properly validate certificates for the broker node. This allows remote non-whitelisted hosts to prevent runs from triggering.

Recommendations For Puppet Enterprise versions 2015.3.x through 2015.3.2, update to version 2015.3.3 to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-2787

Produtos afetados

Puppet Enterprise

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-2787 · Nota de Segurança
• https://puppet.com/security/cve/CVE-2016-2787 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-2787 · Aviso do Fabricante