PT-2014-2106 · Puppet · Puppet

Moritz · Published 2014-02-17 · Updated 2022-05-14 · CVE-2011-0528

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Puppet versions 2.6.0 through 2.6.3

Description The issue allows remote authenticated Puppet nodes to read or modify the resources of other nodes due to improper access restrictions to node resources.

Recommendations For Puppet versions 2.6.0 through 2.6.3, update to a version that properly restricts access to node resources to prevent unauthorized reading or modification of node resources.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-264

Related Identifiers

CVE-2011-0528

GHSA-9PVX-FWWH-W289

Affected Products

Puppet

References · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2011-0528.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-0528 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-0528 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9pvx-fwwh-w289 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0528 · Vendor Advisory
• http://ubuntu.com/usn/USN-1365-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-0528 · Vendor Advisory
• https://github.com/puppetlabs/puppet · Note
• https://github.com/puppetlabs/puppet/commit/eee1a9cdaa5cab6222c8e6ab087d319f976fa4e3 · Note
• http://mail-archive.com/[e-mail]/msg16429.html · Note
• http://mail-archive.com/puppet-users%40googlegroups.com/msg16429.html · Note
• http://openwall.com/lists/oss-security/2011/01/31/5 · Note
• http://openwall.com/lists/oss-security/2011/01/27/6 · Note