PT-2018-17605 · Puppet · Puppet Pe Client Tools

Published 2018-06-14 · Updated 2019-10-03 · CVE-2018-6516

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Puppet PE client tools versions 16.4.x through 16.4.5 Puppet PE client tools versions 17.3.x through 17.3.5 Puppet PE client tools versions 18.1.x through 18.1.1

Description The issue allows an attacker to load arbitrary code with privilege escalation on Windows systems, given a specifically crafted configuration file.

Recommendations For versions 16.4.x through 16.4.5, update to version 16.4.6 or later. For versions 17.3.x through 17.3.5, update to version 17.3.6 or later. For versions 18.1.x through 18.1.1, update to version 18.1.2 or later.

Fix

Related Identifiers

CVE-2018-6516

Affected Products

Puppet Pe Client Tools

References · 3

• https://puppet.com/security/cve/CVE-2018-6516 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-6516 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6516 · Security Note