CVE-2016-2785

Properties

Published:
09.06.2016
Updated:
15.06.2016
Patch available:
Severity:
High
CVSS vector:
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Product:
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet
puppetlabs: puppet
puppetlabs: puppet
puppetlabs: puppet
puppetlabs: puppet
puppetlabs: puppet

Vulnerability description

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

References:

GENTOO: https://security.gentoo.org/glsa/201606-02
CONFIRM: https://puppet.com/security/cve/cve-2016-2785
CONFIRM: https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2