Puppet Enterprise vulnerabilities, page 5
89 vulnerabilities
Known vulnerabilities in Puppet Enterprise, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2017-2294puppetpuppet_enterprise
EPSS score1.16%
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.CVE-2017-7529alpinenginx+19EPSS score62.60%
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.CVE-2017-10690ubuntupuppet+4EPSS score1.00%
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4CVE-2017-10689canonicalubuntu_linux+13EPSS score0.36%
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.CVE-2019-10694puppetpuppet_enterpriseEPSS score1.09%
The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9.CVE-2023-2530puppetpuppet_enterpriseEPSS score1.11%
A privilege escalation allowing remote code execution was discovered in the orchestration service.CVE-2023-1894debianpuppetserver+4EPSS score0.44%
A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.CVE-2023-5255ubuntupuppet+2EPSS score0.48%
For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.CVE-2023-5309puppetpuppet_enterpriseEPSS score0.50%
Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.