PT-2018-17604 · Puppet · Puppet Agent

Publicado 2018-06-11 · Atualizado 2018-08-02 · CVE-2018-6515

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Puppet Agent versions 1.10.x prior to 1.10.13 Puppet Agent versions 5.3.x prior to 5.3.7 Puppet Agent versions 5.5.x prior to 5.5.2

Description The issue allows an attacker to load arbitrary code with privilege escalation on Windows systems using a specially crafted configuration file.

Recommendations For Puppet Agent versions 1.10.x prior to 1.10.13, update to version 1.10.13 or later. For Puppet Agent versions 5.3.x prior to 5.3.7, update to version 5.3.7 or later. For Puppet Agent versions 5.5.x prior to 5.5.2, update to version 5.5.2 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-6515

Produtos afetados

Puppet Agent

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-6515 · Nota de Segurança
• https://puppet.com/security/cve/CVE-2018-6515 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-6515 · Aviso do Fabricante