Description (CNA)
Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Puppet / Puppet Enterprise | affected 2017.3.x prior to 2017.3.4 |
| Puppet / puppetlabs/facter_task | affected prior to 0.1.5 |
| Puppet / puppetlabs/puppet_conf | affected prior to 0.1.5 |
| Puppet / puppetlabs/apt | affected prior to 4.5.1 |
| Puppet / puppetlabs/mysql | affected prior to 5.2.1 |
| Puppet / puppetlabs/apache | affected prior to 2.3.1 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.