Format string error in Puppet Enterprise - CVE-2016-5716
Published: August 9, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU38511
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-5716
CWE-ID: CWE-134
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to execute arbitrary code.
The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.
Affected software
Puppet Enterprise
How to mitigate CVE-2016-5716
Install update from vendor's website.