CVE-2016-9686: Input Validation
Published Feb 8, 2017
·Updated
The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2.
Affected Software
2 affected components
puppet Puppet Enterprise>=2016.4.0<2016.4.3
puppet Puppet Enterprise=2016.5.1
Event History
Feb 8, 2017
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionWeakness
Data Sourced
via NVD·10:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-9686?
CVE-2016-9686 is a high severity vulnerability due to its potential to crash the Puppet Communications Protocol Broker.
2
How do I fix CVE-2016-9686?
To resolve CVE-2016-9686, upgrade to Puppet Enterprise versions 2016.4.3 or 2016.5.2 or later.
3
Which versions of Puppet Enterprise are affected by CVE-2016-9686?
Affected versions include Puppet Enterprise 2016.4.0 to 2016.4.2 and version 2016.5.1.
4
What are the consequences of exploiting CVE-2016-9686?
Exploiting CVE-2016-9686 can lead to the crash of the PCP Broker, hindering command communications with agents.
5
Is CVE-2016-9686 a remote or local exploit?
CVE-2016-9686 can be exploited remotely since it affects the communication protocol.