PT-2013-1229 · Puppet+1 · Puppet+2

Published 2013-03-20 · Updated 2019-07-10 · CVE-2013-1654

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Puppet versions 2.7.x before 2.7.21 Puppet versions 3.1.x before 3.1.1 Puppet Enterprise versions 2.7.x before 2.7.2

Description The issue allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions. This is due to improper SSL protocol negotiation between the client and master. Exploitation of the vulnerabilities may lead to disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely by an attacker who has passed the authentication procedure.

Recommendations For Puppet versions 2.7.x before 2.7.21, update to version 2.7.21 or later. For Puppet versions 3.1.x before 3.1.1, update to version 3.1.1 or later. For Puppet Enterprise versions 2.7.x before 2.7.2, update to version 2.7.2 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09724

CVE-2013-1654

DSA-2643-1

RHSA-2013:0710

Affected Products

Puppet

Puppet Enterprise

Suse

References · 14

• http://rhn.redhat.com/errata/RHSA-2013-0710.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html · Vendor Advisory
• https://puppetlabs.com/security/cve/cve-2013-1654 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1654 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1654 · Vendor Advisory
• http://secunia.com/advisories/52596 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09724 · Security Note
• http://debian.org/security/2013/dsa-2643 · Vendor Advisory
• http://ubuntu.com/usn/usn-1759-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-1654 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201308-04.xml · Note
• http://securityfocus.com/bid/64758 · Note