GitHub Advisoryadvisory · RubyGems
GHSA-9pvx-fwwh-w289 Puppet does not properly restrict access to node resources
MEDIUM
Official page ↗
- Aliases
- CVE-2011-0528
- Ecosystem
- RubyGems
- Packages
- puppet
- Severity
- Moderate
- Weaknesses
- CWE-284
- Reviewed
- 2024-01-16
Affected packages
• RubyGems puppet: >= 2.6.0, < 2.6.4 → fixed in 2.6.4
Description
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.
Related
Alias · CVE (1)
- CVE-2011-0528 Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or… vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-0528 advisory
- https://github.com/puppetlabs/puppet/commit/eee1a9cdaa5cab6222c8e6ab087d319f976fa4e3 web
- https://github.com/puppetlabs/puppet package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2011-0528.yml web
- http://www.mail-archive.com/[email protected]/msg16429.html web
- http://www.openwall.com/lists/oss-security/2011/01/27/6 web
- http://www.openwall.com/lists/oss-security/2011/01/31/5 web
- http://www.ubuntu.com/usn/USN-1365-1 web