CVE-2016-2785: Critical severity puppet vulnerability
Published Jun 10, 2016
·Updated
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
Affected Software
24 affected componentsFixes available
rubygems/puppet<2.3.2
rubygems/puppet>=4.0.0<4.4.2
4.4.2
puppet Puppet=4.0.0
puppet Puppet=4.0.0-rc1
puppet Puppet=4.0.0-rc2
puppet Puppet=4.0.0-rc3
puppet Puppet=4.1.0
puppet Puppet=4.2.0
puppet Puppet=4.2.1
puppet Puppet=4.2.2
puppet Puppet=4.2.3
puppet Puppet=4.3.0
puppet Puppet=4.3.1
puppet Puppet=4.3.2
puppet Puppet=4.4.0
puppet Puppet=4.4.1
Puppet Puppet Server=2.0.0
Puppet Puppet Server=2.1.0
Puppet Puppet Server=2.1.1
Puppet Puppet Server=2.1.2
Puppet Puppet Server=2.2.0
Puppet Puppet Server=2.3.0
Puppet Puppet Server=2.3.1
Puppet Puppet Agent=1.4.1
Event History
Jun 10, 2016
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
May 13, 2022
Advisory Published
01:06 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-2785?
CVE-2016-2785 has a medium severity rating due to its potential to allow unauthorized access by bypassing access restrictions.
2
How do I fix CVE-2016-2785?
To fix CVE-2016-2785, upgrade Puppet Server to version 2.3.2 or later, or Puppet 4.x to version 4.4.2 or later.
3
What versions are affected by CVE-2016-2785?
CVE-2016-2785 affects Puppet Server versions before 2.3.2 and Puppet versions 4.x before 4.4.2.
4
Can CVE-2016-2785 be exploited remotely?
Yes, CVE-2016-2785 can be exploited by remote attackers to bypass access controls.
5
What component is primarily impacted by CVE-2016-2785?
CVE-2016-2785 primarily impacts the auth.conf access restrictions in Puppet Server and Ruby puppetmaster.