CVE-2013-1652 — Puppet vulnerability

CWE-26410 documents8 sources
Severity
4.9MEDIUMNVD
EPSS
0.4%
top 39.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
PuppetPuppetlabs PuppetCanonical Ubuntu Linux+1 more
Timeline
PublishedMar 20
Latest updateMay 14

Description

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 6.8 | Impact: 4.9

Affected Packages4 packages

▶NVDpuppet/puppet_enterprise2.7.0, 2.7.1, 3.1.0+2
▶Debianpuppet/puppet< 2.7.18-3
▶NVDpuppetlabs/puppet2.6.17+5
▶NVDpuppet/puppet16 versions+15

Also affects: Ubuntu Linux 11.10, 12.04, 12.10

🔴Vulnerability Details

3
GHSA
GHSA-3rpq-2xpx-53c4: Puppet before 2↗2022-05-14
▶
CVEList
CVE-2013-1652: Puppet before 2↗2013-03-20
▶
OSV
CVE-2013-1652: Puppet before 2↗2013-03-20
▶

📋Vendor Advisories

3
Red Hat
Puppet: HTTP GET request catalog retrieval↗2013-03-12
▶
Ubuntu
Puppet vulnerabilities↗2013-03-12
▶
Debian
CVE-2013-1652: puppet - Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet En...↗2013
▶

💬Community

3
Bugzilla
CVE-2013-1640 CVE-2013-1652 CVE-2013-1654 CVE-2013-2274 CVE-2013-2275 puppet various flaws [epel-all]↗2013-03-12
▶
Bugzilla
CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2275 puppet various flaws [fedora-all]↗2013-03-12
▶
Bugzilla
CVE-2013-1652 Puppet: HTTP GET request catalog retrieval↗2013-03-10
▶
CVE-2013-1652 — Puppetlabs Puppet vulnerability | cvebase