Puppet Puppet_server
7 CVEs affecting Puppet Puppet_server. Latest disclosed: 2023-10-03. Critical: 2, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27023 | Critical | 9.8 | 2021-11-18 | A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This i… |
CVE-2016-2785 | Critical | 9.8 | 2016-06-10 | Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended au… |
CVE-2020-7943 | High | 7.5 | 2020-03-11 | Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like host… |
CVE-2018-11751 | Medium | 5.4 | 2019-12-16 | Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. |
CVE-2023-1894 | Medium | 5.3 | 2023-05-04 | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted cer… |
CVE-2023-5255 | Medium | 4.4 | 2023-10-03 | For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. |
CVE-2014-7170 | | 2014-12-17 | Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the sta… |