PT-2013-1232 · Puppet+2 · Puppet+3

Published 2013-03-20 · Updated 2019-07-10 · CVE-2013-2275

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Puppet versions prior to 2.7.23 Puppet versions 0.25.0 through 2.6.18 Puppet versions 2.7.x through 2.7.20 Puppet versions 3.1.x through 3.1.0 Puppet Enterprise versions prior to 1.2.7 Puppet Enterprise versions 2.7.x through 2.7.1

Description The issue affects the puppet package in Gentoo Linux and allows remote authenticated attackers to exploit multiple vulnerabilities, potentially leading to breaches of confidentiality, integrity, and availability of protected information. The default configuration of puppet masters enables remote authenticated nodes to submit reports for other nodes via unspecified vectors.

Recommendations For Puppet versions prior to 2.7.23, update to version 2.7.23 or later. For Puppet versions 0.25.0 through 2.6.18, update to version 2.6.18 or later. For Puppet versions 2.7.x through 2.7.20, update to version 2.7.21 or later. For Puppet versions 3.1.x through 3.1.0, update to version 3.1.1 or later. For Puppet Enterprise versions prior to 1.2.7, update to version 1.2.7 or later. For Puppet Enterprise versions 2.7.x through 2.7.1, update to version 2.7.2 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09724

CVE-2013-2275

DSA-2643-1

RHSA-2013:0710

Affected Products

Gentoo Linux

Puppet

Puppet Enterprise

Suse

References · 14

• http://rhn.redhat.com/errata/RHSA-2013-0710.html · Vendor Advisory
• https://puppetlabs.com/security/cve/cve-2013-2275 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2275 · Security Note
• http://debian.org/security/2013/dsa-2643 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09724 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2275 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-2275 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-2275 · Vendor Advisory
• http://ubuntu.com/usn/usn-1759-1 · Vendor Advisory
• http://securityfocus.com/bid/58449 · Note
• http://secunia.com/advisories/52596 · Note
• http://security.gentoo.org/glsa/glsa-201308-04.xml · Note