CVE-2017-2294

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key…

published July 5, 2017

CVSS
—
EPSS
1%
Percentile
66.8
In the wild
Unconfirmed
What it is

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01163 · 66.8th percentile
Published
2017-07-05T15:00Z
EPSS history
Timeline
  • 05 JUL 15:00Z
    Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key…
    cvelistv5