PT-2017-15334 · Puppet · Mcollective-Sshkey-Security Plugin

Published 2017-06-30 · Updated 2021-09-09 · CVE-2017-2298

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions mcollective-sshkey-security plugin versions prior to 0.5.1

Description The issue allows a compromised server to write a file to an arbitrary location on the client. This is achieved by using a server-specified identifier as part of a path where a file is written, with the filename appended with the string " pub.pem".

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the mcollective-sshkey-security plugin to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-2298

Affected Products

Mcollective-Sshkey-Security Plugin

References · 5

• https://puppet.com/security/cve/cve-2017-2298 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2298 · Security Note
• https://github.com/puppetlabs/mcollective-sshkey-security/blob/0.5.1/CHANGELOG.md · Note
• https://github.com/puppetlabs/mcollective-sshkey-security/commit/3388a3109f4fb1c69fa8505e991bf59ca20d19a2 · Note