CVE-2017-10690: Medium severity Puppet Puppet vulnerability
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4
Other sources
puppet-agent before version 5.3.4 has an information disclosure vulnerability that allows an agent to retrieve facts from an environment that it was not classified to retrieve from.
External References:
https://puppet.com/security/cve/CVE-2017-10690
Upstream Issue:
https://tickets.puppetlabs.com/browse/PUP-8225
Upstream Patch:
https://github.com/puppetlabs/puppet/commit/bd87bef2c3862d333f4c1f2b148b147d449a375b
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10690?
CVE-2017-10690 has a moderate severity rating due to its potential for information disclosure.
How do I fix CVE-2017-10690?
To fix CVE-2017-10690, upgrade Puppet Agent to version 5.3.4 or later.
What systems are affected by CVE-2017-10690?
CVE-2017-10690 affects Puppet Agent versions prior to 5.3.4, Puppet Enterprise versions before 2017.3.4, and specific Red Hat Satellite versions.
What type of vulnerability is CVE-2017-10690?
CVE-2017-10690 is classified as an information disclosure vulnerability.
What versions of Puppet need to be upgraded to mitigate CVE-2017-10690?
Puppet Agent versions prior to 5.3.4 and Puppet Enterprise versions earlier than 2017.3.4 need to be upgraded.