CVE-2017-2297

published 2018-02-01

CVE-2017-2297: Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been…

high 7.5 CVSS 3.0

AV N AC H PR L UI N S U C H I H A H

Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5 and 2017.2.1. This only affects users with labeled tokens, which is not the default for tokens.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	puppet	—	—
puppet	puppet_enterprise	< 2016.4.5	2016.4.5
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—

CWE-287