puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a ‘mysql_user’ user parameter contains a host with a netmask.
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Puppetlabs-mysql | Puppet | 3.1.0 | 3.6.0 |
| Puppet-module-puppetlabs-mysql | Ubuntu | upstream | * |