CVE-2016-2787: Medium severity Puppet Puppet Enterprise vulnerability
Published Feb 13, 2017
·Updated
The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors.
Affected Software
2 affected components
Puppet Puppet Enterprise=2015.3.2
Puppetlabs Puppet Enterprise=2015.3
Event History
Feb 13, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-2787?
CVE-2016-2787 is classified as a medium severity vulnerability.
2
How do I fix CVE-2016-2787?
To fix CVE-2016-2787, upgrade Puppet Enterprise to version 2015.3.3 or later.
3
What is affected by CVE-2016-2787?
CVE-2016-2787 affects Puppet Enterprise versions 2015.3.x prior to 2015.3.3.
4
What does CVE-2016-2787 exploit?
CVE-2016-2787 exploits improper certificate validation in the Puppet Communications Protocol.
5
What risks are associated with CVE-2016-2787?
The risks associated with CVE-2016-2787 include unauthorized access by remote hosts, potentially disrupting Puppet operations.