dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files โ including the compiler binary โ with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive,...
7.3CVSS
7.5AI Score
0.0004EPSS
Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML...
9.8CVSS
7.3AI Score
0.001EPSS
For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being...
7.5CVSS
7.4AI Score
0.0005EPSS
A privilege escalation allowing remote code execution was discovered in the orchestration...
9.8CVSS
9.9AI Score
0.002EPSS
A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server...
5.3CVSS
5.1AI Score
0.0005EPSS
All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input...
7.8CVSS
7.9AI Score
0.0004EPSS
A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first...
6.5CVSS
6.3AI Score
0.001EPSS
A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be...
4.4CVSS
4.7AI Score
0.0004EPSS
A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service...
4.9CVSS
5AI Score
0.001EPSS
A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL...
8.8CVSS
8.9AI Score
0.001EPSS