Puppet does not properly restrict access to node resources

MEDIUM 5.5CVE-2011-0528 · GHSA-9pvx-fwwh-w289 · Published 17/02/2014 · updated 16/06/2026

Package	Affected versions	Patched versions
puppet RubyGems	`≥ 2.6.0, < 2.6.4`	`2.6.4`
puppet puppet	`= 2.6.0= 2.6.1= 2.6.2= 2.6.3`	No fix yet

Description

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.

NVD description

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2011-0528 · ADVISORY
puppetlabs/puppet commit eee1a9c · WEB
puppetlabs/puppet · PACKAGE
rubysec/ruby-advisory-db · WEB
mail-archive.com/[email protected]/msg16429.html · WEB
openwall.com/lists/oss-security/2011/01/27/6 · WEB
openwall.com/lists/oss-security/2011/01/31/5 · WEB
ubuntu.com/usn/USN-1365-1 · WEB
mail-archive.com/puppet-users%40googlegroups.com/msg16429.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free