PT-2017-10263 · Puppet · Puppet Enterprise

Published 2017-02-08 · Updated 2019-07-10 · CVE-2016-9686

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2016.4.3 Puppet Enterprise versions prior to 2016.5.2

Description The issue concerns the incorrect validation of message header sizes in the Puppet Communications Protocol (PCP) Broker. This could allow an attacker to crash the PCP Broker, which would prevent commands from being sent to agents.

Recommendations For versions prior to 2016.4.3, update to version 2016.4.3 to resolve the issue. For versions prior to 2016.5.2, update to version 2016.5.2 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-9686

Affected Products

Puppet Enterprise

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-9686 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9686 · Vendor Advisory
• https://puppet.com/security/cve/cve-2016-9686 · Vendor Advisory