CVE-2017-2294

published 2017-07-05

CVE-2017-2294: Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key…

Priority P3 36 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	puppet	—	—
puppet	puppet_enterprise	<= 2016.4.3	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

vendor_debian 7.5 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200