CVE-2017-2293

Published: Feb 1, 2018

Modified: Sep 16, 2024

PUBLISHED

Description

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this functionality can change this policy.

Vendor	Product	Versions
Puppet	Puppet Enterprise	affected `prior to 2016.4.5, 2016.5.x, 2017.1.x, resolved in 2016.4.5 and 2017.2.1`

References

https://puppet.com/security/cve/cve-2017-2293

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2017-2293

Description

Affected Products

References