#VU37572 Input validation error in Puppet Agent - CVE-2017-2296

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU37572

#VU37572 Input validation error in Puppet Agent - CVE-2017-2296

Published: February 1, 2018 / Updated: August 8, 2020


Vulnerability identifier: #VU37572
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-2296
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Puppet Agent
Software vendor:
Puppet Labs

Description

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2.


Remediation

Install update from vendor's website.

External links