Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a comprom

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• puppet puppet5.5.0 and later · before 5.5.19
• puppet puppet6.0.0 and later · before 6.13.0
• puppet puppet agent5.5.0 and later · before 5.5.19
• puppet puppet agent6.0.0 and later · before 6.13.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (puppet). Independent of NVD's CPE analysis and usually ahead of it.

• Puppet Puppet

  • 5.5.x prior to 5.5.19, Fixed in 5.5.19, 6.x prior to 6.13.0, Fixed in 6.13.0affected

• Puppet Puppet Agent

  • 5.5.x prior to 5.5.19, Fixed in 5.5.19, 6.x prior to 6.13.0, Fixed in 6.13.0affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2016-2785Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to
  40Plan
• CVE-2013-1640The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1
  37Monitor
• CVE-2021-27021A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query
  35Monitor
• CVE-2018-6513Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, P
  35Monitor
• CVE-2017-2295Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified
  33Monitor
• CVE-2018-6515Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a speci
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.