CVE-2015-1029: Medium severity puppet stdlib vulnerability
Published Jan 16, 2015
·Updated
The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.
Affected Software
23 affected components
Puppet Stdlib Puppet=2.1.0
Puppet Stdlib Puppet=2.1.1
Puppet Stdlib Puppet=2.1.2
Puppet Stdlib Puppet=2.1.3
Puppet Stdlib Puppet=2.2.0
Puppet Stdlib Puppet=2.2.1
Puppet Stdlib Puppet=2.3.0
Puppet Stdlib Puppet=2.3.1
Puppet Stdlib Puppet=2.3.2
Puppet Stdlib Puppet=2.3.3
Puppet Stdlib Puppet=2.4.0
Puppet Stdlib Puppet=2.5.0
Puppet Stdlib Puppet=3.0.0
Puppet Stdlib Puppet=4.1.0
Puppet Stdlib Puppet=4.2.0
Puppet Stdlib Puppet=4.2.1
Puppet Stdlib Puppet=4.2.2
Puppet Stdlib Puppet=4.3.0
Puppet Stdlib Puppet=4.3.1
Puppet Stdlib Puppet=4.3.2
Puppet Stdlib Puppet=4.4.0
Puppet Stdlib Puppet=4.5.0
Puppet Puppet Enterprise<=2.8.8
Event History
Jan 16, 2015
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1029?
CVE-2015-1029 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2015-1029?
To fix CVE-2015-1029, upgrade the puppetlabs-stdlib module to version 4.5.1 or later.
3
Which versions of puppetlabs-stdlib are affected by CVE-2015-1029?
Versions 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 are affected by CVE-2015-1029.
4
What type of vulnerability is CVE-2015-1029?
CVE-2015-1029 is a privilege escalation vulnerability that allows remote authenticated users to access sensitive information.
5
Can CVE-2015-1029 be exploited remotely?
Yes, CVE-2015-1029 can be exploited by remote authenticated users.