GCVE - cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Puppetlabs (`e023c4c9-4ef3-5dfc-811f-40b125d813f1`)
Product	Puppet (`f85421cc-fb88-5f61-ac25-5034f11e702a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/puppet`	purl2cpe	2026-06-01 10:11:47.025960
`pkg:deb/ubuntu/puppet`	purl2cpe	2026-06-01 10:11:47.025963
`pkg:gem/puppet`	purl2cpe	2026-06-01 10:11:47.025966
`pkg:github/puppetlabs/puppet`	purl2cpe	2026-06-01 10:11:47.025969
`pkg:rpm/fedora/puppet`	purl2cpe	2026-06-01 10:11:47.025971
`pkg:rpm/opensuse/puppet`	purl2cpe	2026-06-01 10:11:47.025974

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-4969`	vulnerable	2026-06-03 14:33:20.166972	Details available Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files. Published: 2014-01-07T18:00:00.000Z Updated: 2024-08-06T16:59:41.037Z Open on db.gcve.eu Reference links http://www.debian.org/security/2013/dsa-2831 http://secunia.com/advisories/56254 http://secunia.com/advisories/56253 http://puppetlabs.com/security/cve/cve-2013-4969 http://www.ubuntu.com/usn/USN-2077-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2275`	vulnerable	2026-06-03 14:33:00.527777	Details available The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors. Published: 2013-03-20T16:00:00.000Z Updated: 2024-08-06T15:27:41.177Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0710.html http://www.debian.org/security/2013/dsa-2643 https://puppetlabs.com/security/cve/cve-2013-2275/ http://secunia.com/advisories/52596	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1652`	vulnerable	2026-06-03 14:32:50.667790	Details available Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors. Published: 2013-03-20T16:00:00.000Z Updated: 2024-08-06T15:13:31.710Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0710.html http://www.debian.org/security/2013/dsa-2643 http://www.securityfocus.com/bid/58443 http://secunia.com/advisories/52596	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3867`	vulnerable	2026-06-03 14:32:01.801695	Details available lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:21:04.014Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014 http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3866`	vulnerable	2026-06-03 14:32:01.800431	Details available lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:21:03.900Z Open on db.gcve.eu Reference links https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014 http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3865`	vulnerable	2026-06-03 14:32:01.799461	Details available Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:21:04.052Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3864`	vulnerable	2026-06-03 14:32:01.797080	Details available Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:21:04.064Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html http://puppetlabs.com/security/cve/cve-2012-3864/ http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3408`	vulnerable	2026-06-03 14:31:58.131178	Details available lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address. Published: 2012-08-06T16:00:00.000Z Updated: 2024-08-06T20:05:12.457Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=839166 http://puppetlabs.com/security/cve/cve-2012-3408/ https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.