CVSS: 5.3EPSS: 0%CPEs: 27EXPL: 0CVE-2013-1654 – Puppet: SSL protocol downgrade
https://notcve.org/view.php?id=CVE-2013-1654
20 Mar 2013 — Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors. Puppet v2.7.x anterior a v2.7.21 y v3.1.x anterior a v3.1.1, y Puppet Enterprise v2.7.x anterior a v2.7.2, no negocian correctamente el protocolo SSL entre el cliente y el master, lo que permite a atacantes remotos llevar a cabo ataqu... • http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html •
CVSS: 7.5EPSS: 0%CPEs: 35EXPL: 0CVE-2013-1655 – Gentoo Linux Security Advisory 2013-08-04
https://notcve.org/view.php?id=CVE-2013-1655
20 Mar 2013 — Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes." Puppet v2.7.x anterior a v2.7.21 y 3.1.x anterior a v3.1.1, cuando ejecutan Ruby v1.9.3 o posterior, permite a atacantes remotos ejecutar código arbitario mediante vectores relacionados con "serialized attributes." Multiple vulnerabilities have been found in Puppet, the worst of which could lead to execution of arbitrary code. ... • http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html • CWE-20: Improper Input Validation •