CVE-2018-6508

CVE-2018-6508: vulnerability in Puppet Enterprise

Published · Updated

Follow this CVE+ Monitor Puppet Enterprise+ Monitor puppetlabs/apache

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.9%
Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.
Affected products
Puppet · Puppet EnterprisePuppet · puppetlabs/apachePuppet · puppetlabs/aptPuppet · puppetlabs/facter_taskPuppet · puppetlabs/mysqlPuppet · puppetlabs/puppet_conf
Related CVEs — Puppet Enterprise

In the same product, most dangerous first.

CVE-2016-5716—CVE-2016-5716EPSS 1.8%CVE-2016-9686—CVE-2016-9686EPSS 1.3%CVE-2017-2294—CVE-2017-2294EPSS 1.2%CVE-2023-2530—CVE-2023-2530EPSS 1.1%CVE-2017-10690—CVE-2017-10690EPSS 1.0%CVE-2017-2296—CVE-2017-2296EPSS 0.9%