Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-1652

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.

Published

2013-03-20T16:55:01.753

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

6.8

Impact Score

4.9

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	puppetlabs	puppet	≤ 2.6.17	Yes
Application	puppet	puppet	2.7.2	Yes
Application	puppet	puppet	2.7.3	Yes
Application	puppet	puppet	2.7.4	Yes
Application	puppet	puppet	2.7.5	Yes
Application	puppet	puppet	2.7.6	Yes
Application	puppet	puppet	2.7.7	Yes
Application	puppet	puppet	2.7.8	Yes
Application	puppet	puppet	2.7.9	Yes
Application	puppet	puppet	2.7.10	Yes
Application	puppet	puppet	2.7.11	Yes
Application	puppet	puppet	2.7.12	Yes
Application	puppet	puppet	2.7.13	Yes
Application	puppet	puppet	2.7.14	Yes
Application	puppet	puppet	2.7.16	Yes
Application	puppet	puppet	2.7.17	Yes
Application	puppet	puppet	2.7.18	Yes
Application	puppetlabs	puppet	2.7.0	Yes
Application	puppetlabs	puppet	2.7.1	Yes
Application	puppetlabs	puppet	2.7.19	Yes
Application	puppetlabs	puppet	2.7.20	Yes
Application	puppetlabs	puppet	2.7.20	Yes
Application	puppet	puppet_enterprise	3.1.0	Yes
Application	puppetlabs	puppet	≤ 1.2.6	Yes
Application	puppet	puppet_enterprise	2.7.0	Yes
Application	puppet	puppet_enterprise	2.7.1	Yes
Operating System	canonical	ubuntu_linux	11.10	Yes
Operating System	canonical	ubuntu_linux	12.04	Yes
Operating System	canonical	ubuntu_linux	12.10	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html Mailing List, Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0710.html Third Party Advisory ([email protected])
http://secunia.com/advisories/52596 Third Party Advisory, Vendor Advisory ([email protected])
http://ubuntu.com/usn/usn-1759-1 Third Party Advisory ([email protected])
http://www.debian.org/security/2013/dsa-2643 Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/58443 Third Party Advisory, VDB Entry ([email protected])
https://puppetlabs.com/security/cve/cve-2013-1652/ Vendor Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0710.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/52596 Third Party Advisory, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://ubuntu.com/usn/usn-1759-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2013/dsa-2643 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/58443 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://puppetlabs.com/security/cve/cve-2013-1652/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)