CVEvulnerability
CVE-2014-3251
4.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-08-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-362
Description
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
Affected configurations
• puppet puppet enterprise (<= 3.2.0)
• puppetlabs mcollective
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- http://puppetlabs.com/security/cve/cve-2014-3251 Vendor Advisory
- http://secunia.com/advisories/59356 secunia.com
- http://secunia.com/advisories/60066 secunia.com
- http://www.osvdb.org/109257 www.osvdb.org
- http://puppetlabs.com/security/cve/cve-2014-3251 Vendor Advisory
- http://secunia.com/advisories/59356 secunia.com
- http://secunia.com/advisories/60066 secunia.com
- http://www.osvdb.org/109257 www.osvdb.org