CVE-2015-1426: Infoleak
Published Feb 23, 2015
·Updated
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Affected Software
70 affected components
Puppet Facter=1.6.0
Puppet Facter=1.6.1-rc1
Puppet Facter=1.6.1-rc2
Puppet Facter=1.6.1-rc3
Puppet Facter=1.6.1-rc4
Puppet Facter=1.6.2-rc1
Puppet Facter=1.6.3-rc1
Puppet Facter=1.6.4-rc1
Puppet Facter=1.6.5-rc1
Puppet Facter=1.6.6-rc1
Puppet Facter=1.6.6-rc2
Puppet Facter=1.6.7-rc1
Puppet Facter=1.6.8-rc1
Puppet Facter=1.6.9-rc1
Puppet Facter=1.6.10-rc1
Puppet Facter=1.6.11-rc1
Puppet Facter=1.6.12-rc1
Puppet Facter=1.6.12-rc2
Puppet Facter=1.6.13-rc1
Puppet Facter=1.6.14-rc1
Puppet Facter=1.6.15-rc1
Puppet Facter=1.6.16
Puppet Facter=1.6.17-rc1
Puppet Facter=1.6.18-rc1
Puppet Facter=1.7.0-rc1
Puppet Facter=1.7.0-rc2
Puppet Facter=1.7.1-rc1
Puppet Facter=1.7.2-rc1
Puppet Facter=1.7.3-rc1
Puppet Facter=1.7.4-rc1
Puppet Facter=1.7.5-rc1
Puppet Facter=1.7.5-rc2
Puppet Facter=2.0.0-rc1
Puppet Facter=2.0.0-rc2
Puppet Facter=2.0.0-rc3
Puppet Facter=2.0.0-rc4
Puppet Facter=2.0.1-rc1
Puppet Facter=2.0.1-rc2
Puppet Facter=2.0.1-rc3
Puppet Facter=2.0.1-rc4
Puppet Facter=2.0.2
Puppet Facter=2.1.0
Puppet Facter=2.2.0
Puppet Facter=2.3.0
Puppet Facter=2.4.0
Puppetlabs Facter=1.6.1
Puppetlabs Facter=1.6.2
Puppetlabs Facter=1.6.3
Puppetlabs Facter=1.6.4
Puppetlabs Facter=1.6.5
Puppetlabs Facter=1.6.6
Puppetlabs Facter=1.6.7
Puppetlabs Facter=1.6.8
Puppetlabs Facter=1.6.9
Puppetlabs Facter=1.6.10
Puppetlabs Facter=1.6.11
Puppetlabs Facter=1.6.12
Puppetlabs Facter=1.6.13
Puppetlabs Facter=1.6.14
Puppetlabs Facter=1.6.15
Puppetlabs Facter=1.6.17
Puppetlabs Facter=1.6.18
Puppetlabs Facter=1.7.0
Puppetlabs Facter=1.7.1
Puppetlabs Facter=1.7.2
Puppetlabs Facter=1.7.3
Puppetlabs Facter=1.7.4
Puppetlabs Facter=1.7.5
Puppetlabs Facter=1.7.6
Puppetlabs Facter=2.0.1
Event History
Feb 23, 2015
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1426?
CVE-2015-1426 is classified as a medium severity vulnerability.
2
How do I fix CVE-2015-1426?
To fix CVE-2015-1426, upgrade Puppet Labs Facter to version 2.5.0 or later.
3
What software versions are affected by CVE-2015-1426?
CVE-2015-1426 affects Puppet Labs Facter versions from 1.6.0 to 2.4.0.
4
What type of vulnerability is CVE-2015-1426?
CVE-2015-1426 is a local privilege escalation vulnerability.
5
Can CVE-2015-1426 expose sensitive information?
Yes, CVE-2015-1426 can allow local users to obtain sensitive Amazon EC2 IAM instance metadata.