CVE-2018-6516: High severity Puppet Puppet Enterprise Client Tools vulnerability
On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Puppet PE client tools (pe-client-tools)to a version that resolves this vulnerability.Fixed in 16.4.6 - Upgrade
Upgrade
Puppet PE client tools (pe-client-tools)to a version that resolves this vulnerability.Fixed in 17.3.6 - Upgrade
Upgrade
Puppet PE client tools (pe-client-tools)to a version that resolves this vulnerability.Fixed in 18.1.2
Event History
Frequently Asked Questions
What is CVE-2018-6516?
CVE-2018-6516 is a vulnerability in Puppet PE client tools on Windows that allows an attacker to load arbitrary code with privilege escalation.
Which versions of Puppet PE client tools are affected?
Puppet PE client tools versions 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 are affected.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by using a specifically crafted configuration file.
Is Microsoft Windows affected by CVE-2018-6516?
No, Microsoft Windows is not affected by this vulnerability.
Where can I find more information about CVE-2018-6516?
You can find more information about CVE-2018-6516 at the following URL: [https://puppet.com/security/cve/CVE-2018-6516](https://puppet.com/security/cve/CVE-2018-6516).