CVE-2013-2274
Fixed in a distro release EPSS 3%
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
Products: puppet, puppetlabs puppet, puppet_enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | puppet | 2.7-1 |
| Debian 6.0 | puppet | 2.6.2-5+squeeze7 |
| Red Hat openstack 2 | puppet | 0:2.6.18-1.el6ost |
| Red Hat openstack 2 | puppet-server | 0:2.6.18-1.el6ost |