CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-2292
https://notcve.org/view.php?id=CVE-2017-2292
Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior. YAML deserializado de las versiones anteriores a 2.10.4 de MCollective de agentes sin llamar a safe_load, permite la potencial ejecución de código arbitraria en el servidor. La solución para esto es llamar a YAML.safe_load en la entrada. • https://puppet.com/security/cve/cve-2017-2292 https://security.gentoo.org/glsa/201709-01 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2295 – puppet: Unsafe YAML deserialization
https://notcve.org/view.php?id=CVE-2017-2295
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML. Las versiones de Puppet anteriores a la 4.10.1 deserializarán datos "off the wire" (del agente al servidor, en este caso) con un formato especificado por el atacante. Esto podría emplearse para forzar la deserialización YAML de forma no segura, lo que conduciría a la ejecución remota de código. • http://www.debian.org/security/2017/dsa-3862 http://www.securityfocus.com/bid/98582 https://puppet.com/security/cve/cve-2017-2295 https://access.redhat.com/security/cve/CVE-2017-2295 https://bugzilla.redhat.com/show_bug.cgi?id=1452651 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2290
https://notcve.org/view.php?id=CVE-2017-2290
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1. En instalaciones de Windows del plugin mcollective-puppet-agent, versión 1.12.0, un usuario no administrador puede crear un ejecutable que será ejecutado con privilegios de administrador en la siguiente ejecución "mco puppet". Usuarios de Puppet Enterprise no están afectados. • http://www.securityfocus.com/bid/96583 https://puppet.com/security/cve/cve-2017-2290 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 0CVE-2016-2788
https://notcve.org/view.php?id=CVE-2016-2788
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command. MCollective 2.7.0 y 2.8.x en versiones anteriores a 2.8.9, como se utiliza en Puppet Enterprise, permite a atacantes remotos ejecutar código arbitrario a través de vectores relacionados con el comando mco ping. • https://puppet.com/security/cve/cve-2016-2788 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-2787
https://notcve.org/view.php?id=CVE-2016-2787
The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors. Puppet Communications Protocol en Puppet Enterprise 2015.3.x en versiones anteriores a 2015.3.3 no valida adecuadamente certificados para el nodo broker, lo que permite a anfitriones remotos no incluidos en la lista blanca prevenir que ejecuciones se desencadenen a través de vectores no especificados. • https://puppet.com/security/cve/CVE-2016-2787 • CWE-284: Improper Access Control •