PT-2017-8751 · Puppet · Puppet Enterprise

Published 2017-08-09 · Updated 2019-07-10 · CVE-2016-5716

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2015.x through 2016.3.x

Description The issue concerns unsafe string reads in the console of Puppet Enterprise, potentially allowing for remote code execution on the console node.

Recommendations For Puppet Enterprise versions 2015.x through 2016.3.x, update to version 2016.4.0 or later to resolve the issue.

Fix

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2016-5716

Affected Products

Puppet Enterprise

References · 3

• https://osv.dev/vulnerability/CVE-2016-5716 · Vendor Advisory
• https://puppet.com/security/cve/pe-console-oct-2016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5716 · Security Note