CVE-2014-3251
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective…
Does this matter?
Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.
Description
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.
- CVSS 2.0
- 4.4 MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 0.18% probability · 7th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- puppet/puppet enterprise · puppetlabs/mcollective
- Source
- cve@mitre.org
EPSS 0.2% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://puppetlabs.com/security/cve/cve-2014-3251Vendor Advisory
- http://secunia.com/advisories/59356
- http://secunia.com/advisories/60066
- http://www.osvdb.org/109257
- http://puppetlabs.com/security/cve/cve-2014-3251Vendor Advisory
- http://secunia.com/advisories/59356
- http://secunia.com/advisories/60066
- http://www.osvdb.org/109257
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.