Puppet Mcollective
2 CVEs affecting Puppet Mcollective. Latest disclosed: 2017-06-30. Critical: 1, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2292 | Critical | 9.0 | 2017-06-30 | Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the ser… |
CVE-2017-2298 | Medium | 6.5 | 2017-06-30 | The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised serv… |