PT-2014-7814 · Puppet · Puppet Server
Published
2014-12-17
·
Updated
2019-07-11
·
CVE-2014-7170
CVSS v2.0
1.9
Low
| Vector | AV:L/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Puppet Server version 0.2.0
Description
A race condition exists, allowing local users to obtain sensitive information by accessing it during a specific time window, namely between package installation or upgrade and the start of the service.
Recommendations
For Puppet Server version 0.2.0, consider applying configuration changes to minimize the risk of exploitation, such as restricting access to sensitive information during the installation or upgrade process. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Puppet Server