CVE-2016-5714

Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
VendorProductVersion
puppetpuppet_enterprise
2015.3.3
puppetpuppet_enterprise
2016.1.1
puppetpuppet_enterprise
2016.1.2
puppetpuppet_enterprise
2016.2.0
puppetpuppet_enterprise
2016.2.1
puppetpuppet_agent
1.3.6 ≤
𝑥
≤ 1.7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
puppet
bullseye
5.5.22-2
fixed
jessie
not-affected
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
puppet
artful
not-affected
zesty
not-affected
xenial
not-affected
trusty
not-affected
Common Weakness Enumeration
References
https://bugs.gentoo.org/597684
https://puppet.com/security/cve/cve-2016-5714
https://puppet.com/security/cve/pxp-agent-oct-2016
https://security.gentoo.org/glsa/201710-12
https://bugs.gentoo.org/597684
https://puppet.com/security/cve/cve-2016-5714
https://puppet.com/security/cve/pxp-agent-oct-2016
https://security.gentoo.org/glsa/201710-12