VulnerabilityModified

CVE-2013-1640

The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute…

HIGH 9.0EPSS 4.93%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.93%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
EPSS: 4.93% probability · 92th percentile
CISA KEV: Not listed
Affected: puppet/puppet · puppet/puppet enterprise · canonical/ubuntu linux
Source: cve@mitre.org

References

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0710.htmlThird Party Advisory
http://secunia.com/advisories/52596Third Party Advisory
http://ubuntu.com/usn/usn-1759-1Third Party Advisory
http://www.debian.org/security/2013/dsa-2643Third Party Advisory
https://puppetlabs.com/security/cve/cve-2013-1640/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0710.htmlThird Party Advisory
http://secunia.com/advisories/52596Third Party Advisory
http://ubuntu.com/usn/usn-1759-1Third Party Advisory
http://www.debian.org/security/2013/dsa-2643Third Party Advisory
https://puppetlabs.com/security/cve/cve-2013-1640/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.