Known Vulnerabilities for Puppet Enterprise by Puppet
Listed below are 10 of the newest known vulnerabilities associated with "Puppet Enterprise" by "Puppet".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2023-5309 json | Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAM... | 9.8 - CRITICAL | 2023-11-07 | 2023-11-15 |
| CVE-2023-2530 json | A privilege escalation allowing remote code execution was discovered in the orchestration service. | 9.8 - CRITICAL | 2023-06-07 | 2023-11-07 |
| CVE-2023-1894 json | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue r... | 5.3 - MEDIUM | 2023-05-04 | 2023-11-07 |
| CVE-2021-27026 json | A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged | 4.4 - MEDIUM | 2021-11-18 | 2022-01-24 |
| CVE-2021-27025 json | A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of... | 6.5 - MEDIUM | 2021-11-18 | 2023-11-07 |
| CVE-2021-27023 json | A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP red... | 9.8 - CRITICAL | 2021-11-18 | 2023-11-07 |
| CVE-2021-27022 json | A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parame... | 4.9 - MEDIUM | 2021-09-07 | 2023-11-07 |
| CVE-2021-27021 json | A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables v... | 8.8 - HIGH | 2021-07-20 | 2022-01-24 |
| CVE-2021-27020 json | Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. | 8.8 - HIGH | 2021-08-30 | 2021-09-07 |
| CVE-2021-27019 json | PuppetDB logging included potentially sensitive system information. | 4.3 - MEDIUM | 2021-08-30 | 2021-09-07 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Puppet | Puppet Enterprise | 3.8.6 | |||
| Application | Puppet | Puppet Enterprise | 3.8.5 | |||
| Application | Puppet | Puppet Enterprise | 3.8.4 | |||
| Application | Puppet | Puppet Enterprise | 3.8.3 | |||
| Application | Puppet | Puppet Enterprise | 3.8.2 | |||
| Application | Puppet | Puppet Enterprise | 3.8.1 | |||
| Application | Puppet | Puppet Enterprise | 3.8.0 | |||
| Application | Puppet | Puppet Enterprise | 3.7.2 | |||
| Application | Puppet | Puppet Enterprise | 3.7.1 | |||
| Application | Puppet | Puppet Enterprise | 3.7.0 | |||
| Application | Puppet | Puppet Enterprise | 3.3.2 | |||
| Application | Puppet | Puppet Enterprise | 3.3.1 | |||
| Application | Puppet | Puppet Enterprise | 3.3.0 | |||
| Application | Puppet | Puppet Enterprise | 3.2.3 | |||
| Application | Puppet | Puppet Enterprise | 3.2.2 | |||
| Application | Puppet | Puppet Enterprise | 3.2.1 | |||
| Application | Puppet | Puppet Enterprise | 3.2.0 | |||
| Application | Puppet | Puppet Enterprise | 3.1.3 | |||
| Application | Puppet | Puppet Enterprise | 3.1.2 | |||
| Application | Puppet | Puppet Enterprise | 3.1.1 |