Input validation error in Puppet Agent - CVE-2017-2296
Published: February 1, 2018 / Updated: August 8, 2020
Vulnerability identifier: #VU37572
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-2296
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Puppet Labs
Affected software:
Puppet Agent
Puppet Agent
Detailed vulnerability description
The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.
In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2.
How to mitigate CVE-2017-2296
Install update from vendor's website.