| Package | Affected versions | Patched versions |
|---|---|---|
| puppet enterprise client tools | ≥ 16.4.0, < 16.4.6≥ 17.3.0, < 17.3.6≥ 18.1.0, < 18.1.2 | 16.4.617.3.618.1.2 |
On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free