Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-6508

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vul

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
puppet

Description

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Puppet Puppet Enterprise

  • 2017.3.x prior to 2017.3.4affected

Puppet puppetlabs/facter_task

  • prior to 0.1.5affected

Puppet puppetlabs/puppet_conf

  • prior to 0.1.5affected

Puppet puppetlabs/apt

  • prior to 4.5.1affected

Puppet puppetlabs/mysql

  • prior to 5.2.1affected

Puppet puppetlabs/apache

  • prior to 2.3.1affected

References