CVE-2017-2294: Infoleak
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2294?
CVE-2017-2294 is considered a medium severity vulnerability due to potential exposure of sensitive keys.
How do I fix CVE-2017-2294?
To fix CVE-2017-2294, upgrade to Puppet Enterprise versions 2016.4.5 or 2017.2.1 or later.
What versions are affected by CVE-2017-2294?
Versions of Puppet Enterprise before 2016.4.5, 2017.2.1, and specific versions 2016.5.1, 2016.5.2, 2017.1.0, and 2017.1.1 are affected by CVE-2017-2294.
What type of data is exposed in CVE-2017-2294?
CVE-2017-2294 potentially exposes MCollective server private keys that can be logged and stored in PuppetDB.
Was the sensitive data type introduced before CVE-2017-2294?
No, the sensitive data type was introduced in Puppet 4.6 to prevent issues like those described in CVE-2017-2294.