CVE-2017-2294 — Sensitive Information Exposure in Enterprise

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 46.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Puppet Enterprise
Timeline
PublishedJul 5
Latest updateMay 13

Description

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDpuppet/puppet_enterprise2016.4.3+4
▶CVEListV5puppet/puppet_enterprisePE prior to 2016.4.5 or 2017.2.1

🔴Vulnerability Details

2
GHSA
GHSA-p5c4-h8f6-v559: Versions of Puppet Enterprise prior to 2016↗2022-05-13
▶
CVEList
CVE-2017-2294: Versions of Puppet Enterprise prior to 2016↗2017-07-05
▶

📋Vendor Advisories

1
Debian
CVE-2017-2294: puppet - Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MColl...↗2017
▶
CVE-2017-2294 — Sensitive Information Exposure | cvebase