CVE-2013-2275: Medium severity puppet vulnerability
The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2275?
CVE-2013-2275 has a moderate severity rating due to its potential for unauthorized report submissions by authenticated nodes.
How do I fix CVE-2013-2275?
To fix CVE-2013-2275, upgrade Puppet to versions 2.6.18, 2.7.21, 3.1.1 or later, as well as ensuring Puppet Enterprise is updated to version 1.2.7 or higher.
Which versions of Puppet are affected by CVE-2013-2275?
CVE-2013-2275 affects Puppet versions from 0.25.0 up to 2.6.17, and various versions of 2.7.x and 3.1.x prior to the respective secure releases.
Can authenticated nodes exploit CVE-2013-2275?
Yes, authenticated nodes can exploit CVE-2013-2275 to submit reports for other nodes if the vulnerable versions are in use.
Is there a workaround for CVE-2013-2275 if I cannot update Puppet?
A possible workaround for CVE-2013-2275 would involve adjusting the Puppet master configurations to restrict report submission to only the intended nodes.