CVE-2017-2294

Published: Jul 5, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.

Affected (5)

Products: Puppet: Puppet Enterprise

Puppet

1 product

Puppet Enterprise

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppet Enterprise	Up to 2016.4.3
Puppet Puppet Enterprise	Version 2016.5.1
Puppet Puppet Enterprise	Version 2016.5.2
Puppet Puppet Enterprise	Version 2017.1.0
Puppet Puppet Enterprise	Version 2017.1.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://puppet.com/security/cve/cve-2017-2294

Source: security@puppet.com

Vendor Advisory

https://puppet.com/security/cve/cve-2017-2294

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.