Vulnerability in Puppet Puppet_enterprise
CVE-2014-3251
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized…
Vulnerability class: Race Condition
EPSS: 0.000 (8.1th percentile) — read the EPSS interpretation.
Affected products
- Puppet Puppet_enterprise
- Puppetlabs Mcollective
- N/a — versions n/a
Weakness classification (CWE)
References
- 109257 (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- 60066 (x_refsource_SECUNIA, third-party-advisory)
- 59356 (x_refsource_SECUNIA, third-party-advisory)