CVE-2018-6508 - Vulnerability Details - OpenCVE

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Puppet	Puppet Enterprise

Configuration 1 [-]

cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/103020
https://nvd.nist.gov/vuln/detail/CVE-2018-6508
https://puppet.com/security/cve/CVE-2018-6508
https://www.cve.org/CVERecord?id=CVE-2018-6508

History

No history.

MITRE

Status: PUBLISHED

Assigner: puppet

Published: 2018-02-09T20:00:00Z

Updated: 2024-09-17T01:55:41.774Z

Reserved: 2018-02-01T00:00:00

Link: CVE-2018-6508

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-02-09T20:29:00.317

Modified: 2024-11-21T04:10:47.917

Link: CVE-2018-6508

Redhat

Severity : Important

Publid Date: 2018-02-05T00:00:00Z

Links: CVE-2018-6508 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Puppet Enterprise", "vendor": "Puppet", "versions": [{"status": "affected", "version": "2017.3.x prior to 2017.3.4"}]}, {"product": "puppetlabs/facter_task", "vendor": "Puppet", "versions": [{"status": "affected", "version": "prior to 0.1.5"}]}, {"product": "puppetlabs/puppet_conf", "vendor": "Puppet", "versions": [{"status": "affected", "version": "prior to 0.1.5"}]}, {"product": "puppetlabs/apt", "vendor": "Puppet", "versions": [{"status": "affected", "version": "prior to 4.5.1"}]}, {"product": "puppetlabs/mysql", "vendor": "Puppet", "versions": [{"status": "affected", "version": "prior to 5.2.1"}]}, {"product": "puppetlabs/apache", "vendor": "Puppet", "versions": [{"status": "affected", "version": "prior to 2.3.1"}]}], "datePublic": "2018-02-05T00:00:00", "descriptions": [{"lang": "en", "value": "Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability."}], "problemTypes": [{"descriptions": [{"description": "Remote Code Execution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-02-15T10:57:01", "orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "puppet"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://puppet.com/security/cve/CVE-2018-6508"}, {"name": "103020", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/103020"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@puppet.com", "DATE_PUBLIC": "2018-02-05T00:00:00", "ID": "CVE-2018-6508", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Puppet Enterprise", "version": {"version_data": [{"version_value": "2017.3.x prior to 2017.3.4"}]}}, {"product_name": "puppetlabs/facter_task", "version": {"version_data": [{"version_value": "prior to 0.1.5"}]}}, {"product_name": "puppetlabs/puppet_conf", "version": {"version_data": [{"version_value": "prior to 0.1.5"}]}}, {"product_name": "puppetlabs/apt", "version": {"version_data": [{"version_value": "prior to 4.5.1"}]}}, {"product_name": "puppetlabs/mysql", "version": {"version_data": [{"version_value": "prior to 5.2.1"}]}}, {"product_name": "puppetlabs/apache", "version": {"version_data": [{"version_value": "prior to 2.3.1"}]}}]}, "vendor_name": "Puppet"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote Code Execution"}]}]}, "references": {"reference_data": [{"name": "https://puppet.com/security/cve/CVE-2018-6508", "refsource": "CONFIRM", "url": "https://puppet.com/security/cve/CVE-2018-6508"}, {"name": "103020", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103020"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:10:10.157Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://puppet.com/security/cve/CVE-2018-6508"}, {"name": "103020", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/103020"}]}]}, "cveMetadata": {"assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "assignerShortName": "puppet", "cveId": "CVE-2018-6508", "datePublished": "2018-02-09T20:00:00Z", "dateReserved": "2018-02-01T00:00:00", "dateUpdated": "2024-09-17T01:55:41.774Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*", "matchCriteriaId": "78C71EEA-3AB4-48EB-8BD2-C2E649141E33", "versionEndIncluding": "2017.3.2", "versionStartIncluding": "2017.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability."}, {"lang": "es", "value": "Puppet Enterprise 2017.3.x anteriores a 2017.3.3 es vulnerable a un error de ejecuci\u00f3n remota cuando una cadena especialmente manipulada se pasaba en las tareas facter_task o puppet_conf. Esta vulnerabilidad solo afecta a tareas en los m\u00f3dulos afectados, por lo que las personas que no usen tareas puppet no se ver\u00e1n afectadas por esta vulnerabilidad."}], "id": "CVE-2018-6508", "lastModified": "2024-11-21T04:10:47.917", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-02-09T20:29:00.317", "references": [{"source": "security@puppet.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/103020"}, {"source": "security@puppet.com", "tags": ["Vendor Advisory"], "url": "https://puppet.com/security/cve/CVE-2018-6508"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/103020"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://puppet.com/security/cve/CVE-2018-6508"}], "sourceIdentifier": "security@puppet.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "nvd@nist.gov", "type": "Primary"}]}