In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retri

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• puppet puppetbefore 5.3.4
• puppet puppet enterprisebefore 2017.3.4
• redhat satellite6.4

Versions reported by the vendor

Affected version ranges reported by the assigning authority (puppet). Independent of NVD's CPE analysis and usually ahead of it.

• Puppet Puppet Agent

  • 5.x prior to 5.3.4affected

• Puppet Puppet Enterprise

  • 2017.3.x prior to 2017.3.4affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2016-2785Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to
  40Plan
• CVE-2013-1640The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1
  37Monitor
• CVE-2021-27021A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query
  35Monitor
• CVE-2018-6513Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, P
  35Monitor
• CVE-2017-2295Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified
  33Monitor
• CVE-2018-6515Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a speci
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

To simplify setup, a service account is granted broad, cluster-wide permissions. The principle of least privilege is skipped during installation.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1kind: ClusterRole2rules:3  - apiGroups: ["*"]4    resources: ["*"]5    verbs: ["*"]

1kind: Role2metadata:3  namespace: lodos-system4rules:5  - apiGroups: ["apps"]6    resources: ["deployments"]7    verbs: ["get", "list", "update"]

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.