VulnerabilityModified

CVE-2013-1652

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's…

MEDIUM 4.9EPSS 1.86%

Does this matter?

Lower severity and a low EPSS score (1.86%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.9 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
EPSS: 1.86% probability · 78th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: puppetlabs/puppet · puppet/puppet · puppet/puppet enterprise · canonical/ubuntu linux
Source: cve@mitre.org

References

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0710.htmlThird Party Advisory
http://secunia.com/advisories/52596Third Party Advisory, Vendor Advisory
http://ubuntu.com/usn/usn-1759-1Third Party Advisory
http://www.debian.org/security/2013/dsa-2643Third Party Advisory
http://www.securityfocus.com/bid/58443Third Party Advisory, VDB Entry
https://puppetlabs.com/security/cve/cve-2013-1652/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0710.htmlThird Party Advisory
http://secunia.com/advisories/52596Third Party Advisory, Vendor Advisory
http://ubuntu.com/usn/usn-1759-1Third Party Advisory
http://www.debian.org/security/2013/dsa-2643Third Party Advisory
http://www.securityfocus.com/bid/58443Third Party Advisory, VDB Entry
https://puppetlabs.com/security/cve/cve-2013-1652/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.