CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2295 – puppet: Unsafe YAML deserialization
https://notcve.org/view.php?id=CVE-2017-2295
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML. Las versiones de Puppet anteriores a la 4.10.1 deserializarán datos "off the wire" (del agente al servidor, en este caso) con un formato especificado por el atacante. Esto podría emplearse para forzar la deserialización YAML de forma no segura, lo que conduciría a la ejecución remota de código. • http://www.debian.org/security/2017/dsa-3862 http://www.securityfocus.com/bid/98582 https://puppet.com/security/cve/cve-2017-2295 https://access.redhat.com/security/cve/CVE-2017-2295 https://bugzilla.redhat.com/show_bug.cgi?id=1452651 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2290
https://notcve.org/view.php?id=CVE-2017-2290
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1. En instalaciones de Windows del plugin mcollective-puppet-agent, versión 1.12.0, un usuario no administrador puede crear un ejecutable que será ejecutado con privilegios de administrador en la siguiente ejecución "mco puppet". Usuarios de Puppet Enterprise no están afectados. • http://www.securityfocus.com/bid/96583 https://puppet.com/security/cve/cve-2017-2290 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 0CVE-2016-2788
https://notcve.org/view.php?id=CVE-2016-2788
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command. MCollective 2.7.0 y 2.8.x en versiones anteriores a 2.8.9, como se utiliza en Puppet Enterprise, permite a atacantes remotos ejecutar código arbitrario a través de vectores relacionados con el comando mco ping. • https://puppet.com/security/cve/cve-2016-2788 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-2787
https://notcve.org/view.php?id=CVE-2016-2787
The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors. Puppet Communications Protocol en Puppet Enterprise 2015.3.x en versiones anteriores a 2015.3.3 no valida adecuadamente certificados para el nodo broker, lo que permite a anfitriones remotos no incluidos en la lista blanca prevenir que ejecuciones se desencadenen a través de vectores no especificados. • https://puppet.com/security/cve/CVE-2016-2787 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9686
https://notcve.org/view.php?id=CVE-2016-9686
The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2. El Puppet Communications Protocol (PCP) Broker valida incorrectamente tamaños de la cabecera del mensaje. Un atacante podría utilizar ésto para bloquear el PCP Broker, evitando que se envíen comandos a los agentes. • https://puppet.com/security/cve/cve-2016-9686 • CWE-20: Improper Input Validation •