{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-03-12T00:00:00", "descriptions": [{"lang": "en", "value": "The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2013-04-11T09:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "SUSE-SU-2013:0618", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"}, {"name": "RHSA-2013:0710", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"}, {"name": "DSA-2643", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2013/dsa-2643"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://puppetlabs.com/security/cve/cve-2013-2275/"}, {"name": "52596", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/52596"}, {"name": "USN-1759-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://ubuntu.com/usn/usn-1759-1"}, {"name": "openSUSE-SU-2013:0641", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"}, {"name": "58449", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/58449"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2013-2275", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "SUSE-SU-2013:0618", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"}, {"name": "RHSA-2013:0710", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"}, {"name": "DSA-2643", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2013/dsa-2643"}, {"name": "https://puppetlabs.com/security/cve/cve-2013-2275/", "refsource": "CONFIRM", "url": "https://puppetlabs.com/security/cve/cve-2013-2275/"}, {"name": "52596", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/52596"}, {"name": "USN-1759-1", "refsource": "UBUNTU", "url": "http://ubuntu.com/usn/usn-1759-1"}, {"name": "openSUSE-SU-2013:0641", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"}, {"name": "58449", "refsource": "BID", "url": "http://www.securityfocus.com/bid/58449"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T15:27:41.177Z"}, "title": "CVE Program Container", "references": [{"name": "SUSE-SU-2013:0618", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"}, {"name": "RHSA-2013:0710", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"}, {"name": "DSA-2643", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2013/dsa-2643"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://puppetlabs.com/security/cve/cve-2013-2275/"}, {"name": "52596", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/52596"}, {"name": "USN-1759-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://ubuntu.com/usn/usn-1759-1"}, {"name": "openSUSE-SU-2013:0641", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"}, {"name": "58449", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/58449"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2013-2275", "datePublished": "2013-03-20T16:00:00", "dateReserved": "2013-02-26T00:00:00", "dateUpdated": "2024-08-06T15:27:41.177Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*", "matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*", "matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*", "matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*", "matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*", "matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*", "matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*", "matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*", "matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*", "matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*", "matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*", "matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*", "matchCriteriaId": "31C87FE4-D9E8-4619-9ADB-DFC2D3FE4FB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.16:*:*:*:*:*:*:*", "matchCriteriaId": "04B6142C-AFC5-4045-8FA1-C07F2BEF487C", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*", "matchCriteriaId": "A703C12C-D698-40C6-9081-2B00624C578D", "versionEndIncluding": "2.6.17", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*", "matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*", "matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*", "matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*", "matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*", "matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*", "matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*", "matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*", "matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*", "matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*", "matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*", "matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*", "matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*", "matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*", "matchCriteriaId": "A1EABC0F-A7A6-4C28-9331-3EEB6D39A0C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*", "matchCriteriaId": "29BBE8DB-8560-4A57-9BCB-D709A697ECDE", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*", "matchCriteriaId": "10E0543B-5B1D-4522-945D-98BD63380500", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*", "matchCriteriaId": "817AB37A-F7B0-4E68-B10A-9E4A358793F3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "3CFF3B0A-2C66-445A-BB5C-136DCAA584FE", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "2A463920-9470-41AB-947B-B2DD7A3AF7C1", "versionEndIncluding": "1.2.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "E3227E6D-27C8-4D6C-A9B7-713558FD9947", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "3153F6B2-9CB2-4A1D-834B-33820EC8F0A0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*", "matchCriteriaId": "E4174F4F-149E-41A6-BBCC-D01114C05F38", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*", "matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors."}, {"lang": "es", "value": "La configuraci\u00f3n por defecto para puppet masters v0.25.0 y posteriores en Puppet anterior a v2.6.18, v2.7.x anterior a v2.7.21 y v3.1.x anterior a 3.1.1, y Puppet Enterprise anterior a v1.2.7 y v2.7.x anterior a v2.7.2, permite a los nodos remotos autenticados enviar informes para otros nodos a trav\u00e9s de vectores no especificados."}], "evaluatorImpact": "Per http://www.ubuntu.com/usn/usn-1759-1/\r\n\"A security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n Ubuntu 12.10\r\n Ubuntu 12.04 LTS\r\n Ubuntu 11.10\"", "id": "CVE-2013-2275", "lastModified": "2024-11-21T01:51:23.440", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2013-03-20T16:55:01.843", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/52596"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://ubuntu.com/usn/usn-1759-1"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://www.debian.org/security/2013/dsa-2643"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/58449"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://puppetlabs.com/security/cve/cve-2013-2275/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/52596"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://ubuntu.com/usn/usn-1759-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.debian.org/security/2013/dsa-2643"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/58449"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://puppetlabs.com/security/cve/cve-2013-2275/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "[email protected]", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Puppet Labs for reporting this issue.", "affected_release": [{"advisory": "RHSA-2013:0710", "cpe": "cpe:/a:redhat:openstack:2::el6", "package": "puppet-0:2.6.18-1.el6ost", "product_name": "OpenStack Folsom for RHEL 6", "release_date": "2013-04-04T00:00:00Z"}], "bugzilla": {"description": "Puppet: default auth.conf allows authenticated node to submit a report for any other node", "id": "919785", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=919785"}, "csaw": false, "cvss": {"cvss_base_score": "4.0", "cvss_scoring_vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "status": "verified"}, "details": ["The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors."], "name": "CVE-2013-2275", "package_state": [{"cpe": "cpe:/a:cloudforms_tools:1", "fix_state": "Will not fix", "package_name": "puppet", "product_name": "Red Hat CloudForms Tools 1"}, {"cpe": "cpe:/a:redhat:openstack:2.1", "fix_state": "Affected", "package_name": "puppet", "product_name": "Red Hat OpenStack Platform 2.1"}, {"cpe": "cpe:/a:rhel_sam:1", "fix_state": "Affected", "package_name": "puppet", "product_name": "Red Hat Subscription Asset Manager"}], "public_date": "2013-03-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2013-2275\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-2275\nhttps://puppetlabs.com/security/cve/cve-2013-2275/"], "threat_severity": "Moderate", "upstream_fix": "puppet 2.6.18, puppet 2.7.21, puppet 3.1.1"}