CVE-2017-2298

The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written

published June 30, 2017

CVSS
—
EPSS
1%
Percentile
73.8
In the wild
Unconfirmed
What it is

The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to write a file to an arbitrary location on the client with the filename appended with the string "_pub.pem".

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01494 · 73.8th percentile
Published
2017-06-30T20:00Z
EPSS history
Timeline
  • 30 JUN 20:00Z
    The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written
    cvelistv5