GitHub Advisoryadvisory · RubyGems
GHSA-pqj5-7r86-64fv Puppet Improper Access Control
CRITICAL
Official page ↗
- Aliases
- CVE-2016-2785
- Ecosystem
- RubyGems
- Packages
- puppet
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-284
- Reviewed
- 2023-07-28
Affected packages
• RubyGems puppet: >= 4.0.0, < 4.4.2 → fixed in 4.4.2
Description
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
Related
Alias · CVE (1)
- CVE-2016-2785 Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers… vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-2785 advisory
- https://github.com/puppetlabs/puppet/commit/6592a8166572e5f1b7d058474059b8519ec81387 web
- https://github.com/puppetlabs/puppet package
- https://github.com/puppetlabs/puppet/commits/4.4.2 web
- https://puppet.com/security/cve/cve-2016-2785 web
- https://security.gentoo.org/glsa/201606-02 web