CVE-2014-3251
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective…
Does this matter?
Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.
Description
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
- CVSS 2.0
- 4.4 MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 0.18% probability · 7th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- puppet/puppet enterprise · puppetlabs/mcollective
- Source
- cve@mitre.org
References
- http://puppetlabs.com/security/cve/cve-2014-3251Vendor Advisory
- http://secunia.com/advisories/59356
- http://secunia.com/advisories/60066
- http://www.osvdb.org/109257
- http://puppetlabs.com/security/cve/cve-2014-3251Vendor Advisory
- http://secunia.com/advisories/59356
- http://secunia.com/advisories/60066
- http://www.osvdb.org/109257
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.