PT-2018-17604 · Puppet · Puppet Agent

Published 2018-06-11 · Updated 2018-08-02 · CVE-2018-6515

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Puppet Agent versions 1.10.x prior to 1.10.13 Puppet Agent versions 5.3.x prior to 5.3.7 Puppet Agent versions 5.5.x prior to 5.5.2

Description The issue allows an attacker to load arbitrary code with privilege escalation on Windows systems using a specially crafted configuration file.

Recommendations For Puppet Agent versions 1.10.x prior to 1.10.13, update to version 1.10.13 or later. For Puppet Agent versions 5.3.x prior to 5.3.7, update to version 5.3.7 or later. For Puppet Agent versions 5.5.x prior to 5.5.2, update to version 5.5.2 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-6515

Affected Products

Puppet Agent

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-6515 · Security Note
• https://puppet.com/security/cve/CVE-2018-6515 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-6515 · Vendor Advisory