CVE-2016-2786: Input Validation
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2786?
CVE-2016-2786 is considered a critical vulnerability due to its potential to allow remote code execution.
Which versions are affected by CVE-2016-2786?
CVE-2016-2786 affects Puppet Enterprise versions 2015.3.x before 2015.3.3 and Puppet Agent versions 1.3.x before 1.3.6.
How do I fix CVE-2016-2786?
To fix CVE-2016-2786, upgrade Puppet Enterprise to version 2015.3.3 or later and Puppet Agent to version 1.3.6 or later.
What type of attack does CVE-2016-2786 allow?
CVE-2016-2786 allows remote attackers to spoof brokers and execute arbitrary commands through crafted server certificates.
Is there any workaround for CVE-2016-2786?
There are no known workarounds for CVE-2016-2786; the only solution is to update to the patched versions.