CVE-2022-3275: Puppetlabs-apt Command Injection
Published Oct 7, 2022
·Updated
Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
Affected Software
3 affected components
Puppet puppetlabs-mysql<9.0.0
Fedoraproject Fedora=36
Fedoraproject Fedora=37
Event History
Oct 7, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2022-3275?
CVE-2022-3275 is a vulnerability in the puppetlabs-apt module, allowing command injection.
2
What is the severity of CVE-2022-3275?
The severity of CVE-2022-3275 is critical, with a severity value of 9.8.
3
How can a malicious actor exploit CVE-2022-3275?
A malicious actor can exploit CVE-2022-3275 by providing unsanitized input to the puppetlabs-apt module.
4
Which versions of the puppetlabs-apt module are affected by CVE-2022-3275?
Versions prior to 9.0.0 of the puppetlabs-apt module are affected by CVE-2022-3275.
5
Are most deployments of Puppet and Puppet Enterprise affected by CVE-2022-3275?
No, the condition to exploit CVE-2022-3275 is rare in most deployments of Puppet and Puppet Enterprise.