CVE-2015-7328: Infoleak
Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7328?
CVE-2015-7328 is considered a high severity vulnerability due to the exposure of sensitive information through world-readable permissions.
How do I fix CVE-2015-7328?
To fix CVE-2015-7328, ensure that the permissions for the Certification Authority private key are set to restrict access for local users.
What software versions are affected by CVE-2015-7328?
CVE-2015-7328 affects Puppet Enterprise versions 3.8.0 to 3.8.2 and 2015.2.0 to 2015.2.2.
What is the impact of CVE-2015-7328?
The impact of CVE-2015-7328 allows local users to access sensitive information stored in the Certification Authority private key.
Is there a patch available for CVE-2015-7328?
Yes, a patch is available in Puppet Enterprise version 3.8.3 and 2015.2.3 or later to mitigate CVE-2015-7328.