PT-2018-7107 · Puppet · Puppet Enterprise

Published 2018-02-01 · Updated 2022-01-24 · CVE-2017-2293

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions prior to 2016.4.5 Puppet Enterprise versions prior to 2017.2.1

Description: The issue concerns a configuration in MCollective that allows the package plugin to install or remove arbitrary packages on all managed agents. This configuration poses a risk as it can be exploited to compromise the security of the system. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations: For versions prior to 2016.4.5, update to version 2016.4.5 or later to resolve the issue. For versions prior to 2017.2.1, update to version 2017.2.1 or later to resolve the issue. As a temporary workaround, consider changing the default policy to not allow the package plugin to install or remove arbitrary packages on all managed agents.

Fix

Related Identifiers

CVE-2017-2293

Affected Products

Puppet Enterprise

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-2293 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2293 · Vendor Advisory
• https://puppet.com/security/cve/cve-2017-2293 · Vendor Advisory
• https://t.me/cvenotify/25770 · Telegram Post