Known Vulnerabilities for products from Puppet
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Puppet".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2023-5309 json | Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAM... | 9.8 - CRITICAL | 2023-11-07 | 2023-11-15 |
| CVE-2023-5255 json | For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from bei... | 7.5 - HIGH | 2023-10-03 | 2023-10-05 |
| CVE-2023-5214 json | In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified. | 9.8 - CRITICAL | 2023-10-06 | 2023-11-02 |
| CVE-2023-2530 json | A privilege escalation allowing remote code execution was discovered in the orchestration service. | 9.8 - CRITICAL | 2023-06-07 | 2023-11-07 |
| CVE-2023-1894 json | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue r... | 5.3 - MEDIUM | 2023-05-04 | 2023-11-07 |
| CVE-2022-3276 json | Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit th... | 8.8 - HIGH | 2022-10-07 | 2023-06-29 |
| CVE-2022-3275 json | Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this ... | 9.8 - CRITICAL | 2022-10-07 | 2023-11-07 |
| CVE-2022-0675 json | In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rul... | 9.8 - CRITICAL | 2022-03-02 | 2022-03-09 |
| CVE-2021-27026 json | A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged | 4.4 - MEDIUM | 2021-11-18 | 2022-01-24 |
| CVE-2021-27025 json | A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of... | 6.5 - MEDIUM | 2021-11-18 | 2023-11-07 |
| CVE-2021-27024 json | A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being... | 8.1 - HIGH | 2021-11-18 | 2022-07-12 |
| CVE-2021-27023 json | A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP red... | 9.8 - CRITICAL | 2021-11-18 | 2023-11-07 |
| CVE-2021-27022 json | A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parame... | 4.9 - MEDIUM | 2021-09-07 | 2023-11-07 |
| CVE-2021-27021 json | A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables v... | 8.8 - HIGH | 2021-07-20 | 2022-01-24 |
| CVE-2021-27020 json | Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. | 8.8 - HIGH | 2021-08-30 | 2021-09-07 |
| CVE-2021-27019 json | PuppetDB logging included potentially sensitive system information. | 4.3 - MEDIUM | 2021-08-30 | 2021-09-07 |
| CVE-2021-27018 json | The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an ... | 7.5 - HIGH | 2021-08-30 | 2021-09-07 |
| CVE-2020-7945 json | Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to... | 5.5 - MEDIUM | 2020-09-18 | 2020-09-30 |
| CVE-2020-7944 json | In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive param... | 7.7 - HIGH | 2020-03-26 | 2020-04-01 |
| CVE-2020-7943 json | Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB... | 7.5 - HIGH | 2020-03-11 | 2022-01-24 |
Known software with vulnerabilities from Puppet
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Puppet | Chloride | 0.1.0 |
| Application | Puppet | Cisco Ios | 0.1.0 |
| Application | Puppet | Continuous Delivery | - |
| Application | Puppet | Device Manager | 2.7.0 |
| Application | Puppet | Discovery | 1.0.0 |
| Application | Puppet | Facter | 1.0.1 |
| Application | Puppet | Hiera | 0.1.0 |
| Application | Puppet | Marionette Collective | - |
| Application | Puppet | Mcollective | 0.2.0 |
| Application | Puppet | Puppet | 0.1.3 |
| Application | Puppet | Puppetdb | 0.10.0 |
| Application | Puppet | Puppetlabs-apache | 0.0.4 |
| Application | Puppet | Puppet Agent | 0.1.0 |
| Application | Puppet | Puppet Dashboard | 0.0.1 |
| Application | Puppet | Puppet Enterprise | 1.0 |
| Application | Puppet | Puppet Server | 0.1.10 |
| Application | Puppet | Razor-server | 0.14.0 |
| Application | Puppet | Stdlib | 0.1.1 |