USN-3308-1: Puppet vulnerabilities
Dennis Rowe discovered that Puppet incorrectly handled the search path. A local attacker could use this issue to possibly execute arbitrary code. (CVE-2014-3248) It was discovered that Puppet incorrectly handled YAML deserialization. A remote attacker could possibly use this issue to execute arbitrary code on the master. This update is incompatible with agents older than 3.2.2. (CVE-2017-2295)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-3308-1?
The severity of USN-3308-1 is considered high due to the potential for local and remote code execution.
How can I mitigate the vulnerability identified in USN-3308-1?
To mitigate the vulnerability in USN-3308-1, it is recommended to update Puppet to a secure version that addresses these issues.
Who discovered the vulnerabilities mentioned in USN-3308-1?
The vulnerabilities in USN-3308-1 were discovered by Dennis Rowe.
What specific systems are affected by USN-3308-1?
USN-3308-1 affects Ubuntu 14.04 systems running version 3.4.3-1ubuntu1.2 of puppet-common.
Can USN-3308-1 allow unauthorized access to my system?
Yes, USN-3308-1 could potentially allow unauthorized local or remote code execution on your system.