CVE-2017-10690
First published: Fri Feb 09 2018(Updated: )
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4
Credit: security@puppet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/puppet-agent | <5.3.4 | 5.3.4 |
| Puppet | <5.3.4 | |
| Puppet Enterprise | <2017.3.4 | |
| Red Hat Satellite | =6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://puppet.com/security/cve/CVE-2017-10690
- https://tickets.puppetlabs.com/browse/PUP-8225
- https://github.com/puppetlabs/puppet/commit/bd87bef2c3862d333f4c1f2b148b147d449a375b
- https://access.redhat.com/security/updates/classification/
- https://access.redhat.com/errata/RHSA-2018:2927
- https://bugzilla.redhat.com/show_bug.cgi?id=1566764
Frequently Asked Questions
What is the severity of CVE-2017-10690?
CVE-2017-10690 has a moderate severity rating due to its potential for information disclosure.
How do I fix CVE-2017-10690?
To fix CVE-2017-10690, upgrade Puppet Agent to version 5.3.4 or later.
What systems are affected by CVE-2017-10690?
CVE-2017-10690 affects Puppet Agent versions prior to 5.3.4, Puppet Enterprise versions before 2017.3.4, and specific Red Hat Satellite versions.
What type of vulnerability is CVE-2017-10690?
CVE-2017-10690 is classified as an information disclosure vulnerability.
What versions of Puppet need to be upgraded to mitigate CVE-2017-10690?
Puppet Agent versions prior to 5.3.4 and Puppet Enterprise versions earlier than 2017.3.4 need to be upgraded.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-10690
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/puppet
- canonical/puppet
- canonical/puppet enterprise
- vendor/redhat
- canonical/red hat satellite
- version/red hat satellite/6.4