CVE-2016-9686 — Improper Input Validation in Enterprise

CWE-20 — Improper Input Validation4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.4%
top 40.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Puppet Enterprise
Timeline
PublishedFeb 8
Latest updateMay 14

Description

The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDpuppet/puppet_enterprise2016.4.0 — 2016.4.3+1
▶CVEListV5puppet/puppet_enterprise2015.3.x, 2016.5.1., 2016.x prior to 2016.4.3+2

🔴Vulnerability Details

2
GHSA
GHSA-9pfr-f5q4-v4v8: The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes↗2022-05-14
▶
CVEList
CVE-2016-9686: The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes↗2017-02-08
▶

📋Vendor Advisories

1
Debian
CVE-2016-9686: puppet - The Puppet Communications Protocol (PCP) Broker incorrectly validates message he...↗2016
▶
CVE-2016-9686 — Improper Input Validation in Enterprise | cvebase