GCVE - cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Puppetlabs (`e023c4c9-4ef3-5dfc-811f-40b125d813f1`)
Product	Puppet (`f85421cc-fb88-5f61-ac25-5034f11e702a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/puppet`	purl2cpe	2026-06-01 10:11:47.025960
`pkg:deb/ubuntu/puppet`	purl2cpe	2026-06-01 10:11:47.025963
`pkg:gem/puppet`	purl2cpe	2026-06-01 10:11:47.025966
`pkg:github/puppetlabs/puppet`	purl2cpe	2026-06-01 10:11:47.025969
`pkg:rpm/fedora/puppet`	purl2cpe	2026-06-01 10:11:47.025971
`pkg:rpm/opensuse/puppet`	purl2cpe	2026-06-01 10:11:47.025974

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-4969`	vulnerable	2026-06-08 05:04:50.366699	Details available Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files. Published: 2014-01-07T18:00:00.000Z Updated: 2024-08-06T16:59:41.037Z Open on db.gcve.eu Reference links http://www.debian.org/security/2013/dsa-2831 http://secunia.com/advisories/56254 http://secunia.com/advisories/56253 http://puppetlabs.com/security/cve/cve-2013-4969 http://www.ubuntu.com/usn/USN-2077-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2275`	vulnerable	2026-06-08 05:04:24.295371	Details available The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors. Published: 2013-03-20T16:00:00.000Z Updated: 2024-08-06T15:27:41.177Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0710.html http://www.debian.org/security/2013/dsa-2643 https://puppetlabs.com/security/cve/cve-2013-2275/ http://secunia.com/advisories/52596	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1652`	vulnerable	2026-06-08 05:03:55.317478	Details available Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors. Published: 2013-03-20T16:00:00.000Z Updated: 2024-08-06T15:13:31.710Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0710.html http://www.debian.org/security/2013/dsa-2643 http://www.securityfocus.com/bid/58443 http://secunia.com/advisories/52596	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3867`	vulnerable	2026-06-08 05:02:14.069641	Details available lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:21:04.014Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014 http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3866`	vulnerable	2026-06-08 05:02:14.068391	Details available lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:21:03.900Z Open on db.gcve.eu Reference links https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014 http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3865`	vulnerable	2026-06-08 05:02:14.067414	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3864`	vulnerable	2026-06-08 05:02:14.064820	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3408`	vulnerable	2026-06-08 05:02:09.642693	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.