CVE Vulnerabilities

CVE-2017-2293

Published: Feb 01, 2018 | Modified: Jan 24, 2022
CVSS 3.x
4.9
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5.5 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this functionality can change this policy.

Affected Software

Name Vendor Start Version End Version
Puppet_enterprise Puppet * 2016.4.5 (excluding)
Puppet_enterprise Puppet 2016.5.1 (including) 2016.5.1 (including)
Puppet_enterprise Puppet 2016.5.2 (including) 2016.5.2 (including)
Puppet_enterprise Puppet 2017.1.0 (including) 2017.1.0 (including)
Puppet_enterprise Puppet 2017.1.1 (including) 2017.1.1 (including)

References