PT-2015-4278 · Puppet · Puppetlabs-Rabbitmq

Published 2015-02-03 · Updated 2022-05-14 · CVE-2014-9568

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions puppetlabs-rabbitmq versions 3.0 through 4.1

Description The issue allows local users to obtain sensitive information. This is demonstrated by using Facter to access the RabbitMQ Erlang cookie value stored in the facts of a node.

Recommendations For versions 3.0 through 4.1, consider restricting access to the node facts to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-9568

GHSA-H3GH-978R-747W

Affected Products

Puppetlabs-Rabbitmq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-9568 · Security Note
• http://puppetlabs.com/security/cve/cve-2014-9568 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h3gh-978r-747w · Vendor Advisory
• https://hex.pm/packages/rabbit_common · Note