GCVE - cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*

part: a version: 2.6.15 update: *

Vendor	Puppet (`056a1ba3-12b3-5ecf-a97f-ab3b403c7816`)
Product	Puppet (`7d8fb82a-9b62-59b4-94cc-efb68e8fe2b8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/puppet`	purl2cpe	2026-06-01 10:14:37.053626
`pkg:deb/ubuntu/puppet`	purl2cpe	2026-06-01 10:14:37.053627
`pkg:github/puppetlabs/puppet`	purl2cpe	2026-06-01 10:14:37.053629
`pkg:puppet/open-source-puppet`	purl2cpe	2026-06-01 10:14:37.053630
`pkg:rpm/fedora/puppet`	purl2cpe	2026-06-01 10:14:37.053631
`pkg:rpm/opensuse/puppet`	purl2cpe	2026-06-01 10:14:37.053632

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-2275`	vulnerable	2026-06-03 14:33:00.525397	Details available The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors. Published: 2013-03-20T16:00:00.000Z Updated: 2024-08-06T15:27:41.177Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0710.html http://www.debian.org/security/2013/dsa-2643 https://puppetlabs.com/security/cve/cve-2013-2275/ http://secunia.com/advisories/52596	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2274`	vulnerable	2026-06-03 14:33:00.522357	Details available Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report. Published: 2013-03-20T16:00:00.000Z Updated: 2024-08-06T15:27:41.143Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0710.html http://www.debian.org/security/2013/dsa-2643 http://www.securityfocus.com/bid/58447 https://puppetlabs.com/security/cve/cve-2013-2274/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3867`	vulnerable	2026-06-03 14:32:01.801368	Details available lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:21:04.014Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014 http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3865`	vulnerable	2026-06-03 14:32:01.799761	Details available Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:21:04.052Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3864`	vulnerable	2026-06-03 14:32:01.788769	Details available Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:21:04.064Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html http://puppetlabs.com/security/cve/cve-2012-3864/ http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.