Approved changes feed: RSS · Atom
cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Puppet (056a1ba3-12b3-5ecf-a97f-ab3b403c7816) |
|---|---|
| Product | Puppet (7d8fb82a-9b62-59b4-94cc-efb68e8fe2b8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/puppet |
purl2cpe | 2026-06-01 10:14:36.955708 |
pkg:deb/ubuntu/puppet |
purl2cpe | 2026-06-01 10:14:36.955711 |
pkg:github/puppetlabs/puppet |
purl2cpe | 2026-06-01 10:14:36.955714 |
pkg:puppet/open-source-puppet |
purl2cpe | 2026-06-01 10:14:36.955716 |
pkg:rpm/fedora/puppet |
purl2cpe | 2026-06-01 10:14:36.955719 |
pkg:rpm/opensuse/puppet |
purl2cpe | 2026-06-01 10:14:36.955722 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-27021 |
vulnerable | 2026-06-08 05:30:45.748296 |
Details available
A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.
Published: 2021-07-20T10:44:49.000Z
Updated: 2024-08-03T20:40:47.020Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-7942 |
vulnerable | 2026-06-08 05:27:14.533546 |
Details available
Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19
Published: 2020-02-19T20:52:03.000Z
Updated: 2024-08-04T09:48:24.553Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-6515 |
vulnerable | 2026-06-08 05:11:53.904984 |
Details available
Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation.
Published: 2018-06-11T20:00:00.000Z
Updated: 2024-09-16T23:10:26.852Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-6514 |
vulnerable | 2026-06-08 05:11:53.904562 |
Details available
In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation.
Published: 2018-06-11T20:00:00.000Z
Updated: 2024-09-16T17:49:24.249Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-6513 |
vulnerable | 2026-06-08 05:11:53.903097 |
Details available
Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. This was possible through the loading of shared libraries from untrusted paths.
Published: 2018-06-11T20:00:00.000Z
Updated: 2024-09-17T01:46:25.460Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-2295 |
vulnerable | 2026-06-08 05:09:24.106439 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-10690 |
vulnerable | 2026-06-08 05:08:36.228771 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-10689 |
vulnerable | 2026-06-08 05:08:36.227445 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-3250 |
vulnerable | 2026-06-08 05:05:31.955487 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-3248 |
vulnerable | 2026-06-08 05:05:31.949223 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-1653 |
vulnerable | 2026-06-08 05:03:55.331496 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-1640 |
vulnerable | 2026-06-08 05:03:55.289029 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-1988 |
vulnerable | 2026-06-08 05:00:52.193934 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-1987 |
vulnerable | 2026-06-08 05:00:52.192354 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.