Author: paulvill

Infrastructure Security

This process should be followed for reporting issues with Puppet Labs infrastructure such as:

• puppetlabs.com
• puppetconf.com
• docs.puppetlabs.com
• tickets.puppetlabs.com
• ask.puppetlabs.com
• yum/apt.puppetlabs.com
• and any of our other web properties other than the Forge

While we do believe in crediting security researchers who make valuable contributions to our product security, note that we do not typically provide such credit for minor infrastructure security issues on our web properties.

Note that we do not consider the following class of issues to be report-worthy when they relate to our infrastructure:

• Software version/Banner disclosure
• Directory traversal on yum/apt/downloads.puppetlabs.com where traversal is explicitly desired
• Self-XSS/CSRF on unauthenticated web forms (including logout CSRF)
• Disclosure/Discovery of known public files or directories(e.g., robots.txt, simple DNS enumeration)
• Brute Force attempts (e.g., Login Page/Forgot Password without lockouts)
• Account enumeration (e.g., enumerating Login/Reset fields for valid accounts without lockouts)

To contact the Puppet Labs Infrastructure team, please use the email address:
security-infrastructure@puppetlabs.com

Product Security

This process should be followed for reporting issues with any Puppet Labs Products such as Puppet Enterprise, Puppet and MCollective, as well as the Puppet Forge. This process should also be followed for any security issues related to packages we distribute, however please follow the Infrastructure Security process for the infrastructure hosting those packages (yum/apt.puppetlabs.com, etc.)

If you wish to contact the Puppet Labs Security Team via encrypted communication, we encourage you to use our GPG Public Key:

Puppet Labs Security Team <security@puppetlabs.com>
Key Long-format ID: 8728524FE21D3FC6
Key Fingerprint: 489C F9E6 BB24 2589 EFF5 BB68 8728 524F E21D 3FC6

The key is available in ASCII encoded format here. It can also be retrieved and verified from the MIT Key Server.

Puppet Labs is happy to fully disclose all details of a security vulnerability but in the interest of coordinated disclosure we do ask security researchers and other stakeholders to allow us sufficient time to patch the vulnerability before publishing the details.

We believe in crediting security researchers based on the value of the contributions provided. Our security team reviews each disclosure and assigns a scored value based on the relevance of the disclosure. These scores are calculated quarterly and the top individuals are publicly credited on our website. Additional credit will be awarded to those that provide code fixes or additional information about how to fix the disclosure.

Security Disclosures

• Oracle Java January 2016 Security Fixes
• Resolved in Puppet Enterprise 2015.3.2 and Puppet Enterprise 3.8.4
• Rails January 2016 Security Fixes
• Resolved in Puppet Enterprise 3.8.4
• Passenger December 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.4
• ActiveMQ December 2015 Security Fixes
• Resolved in Puppet Enterprise 2015.3.2 and Puppet Enterprise 3.8.4
• OpenSSL January 2016 Security Fixes
• Resolved in Puppet Enterprise 2015.3.2, Puppet Enterprise 3.8.4, Puppet Agent 1.3.5 and Puppet 3.8.6 (Windows)
• OpenSSL December 2015 Security Fixes
• Resolved in Puppet Agent 1.3.4
• CVE-2015-7551 – Fiddle and DL Ruby Vulnerability
• Resolved in Puppet Enterprise 2015.3.2, Puppet Enterprise 3.8.4, Puppet Agent 1.3.4 and Puppet 3.8.5 (Windows)
• CVE-2015-7330 – Non-whitelisted hosts could access Puppet communications protocol
• Resolved in Puppet Enterprise 2015.3.1
• CVE-2015-8470 – Puppet Enterprise Console JSESSIONID Cookies Are Issued Without the Secure Flag
• Resolved in Puppet Enterprise 2015.3.0
• Advisory: puppetlabs-ntp default configuration does not fully mitigate CVE-2013-5211
• Resolved in puppetlabs-ntp 4.1.1
• Oracle Java October 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.3 and 2015.2.3
• PostgreSQL October 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.3 and 2015.2.3
• CVE-2015-7328 – World-Readable CA Keys in Puppet Server
• Resolved in Puppet Enterprise 3.8.3 and 2015.2.3
• CVE-2015-6501 – Arbitrary URL Redirection in Puppet Enterprise Console
• Resolved in Puppet Enterprise 2015.2.1
• CVE-2015-6502 – Reflected Cross Site Scripting in Login Redirect
• Resolved in Puppet Enterprise 2015.2.1
• CVE-2015-7224 – puppetlabs-mysql can unexpectedly create database user accounts with no password
• Resolved in puppetlabs-mysql 3.6.1
• Advisory: Use of the ‘port’ parameter with puppetlabs-firewall could cause unexpectedly permissive firewall rules.
• Resolved in puppetlabs-firewall 1.7.1
• Advisory: `pe-java` Was Not Updated on the Console Node on Split Upgrades
• Resolved in Puppet Enterprise 3.8.2
• Ruby on Rails Project June 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.2
• CVE-2015-3183 – HTTP Request Smuggling Vulnerability in Apache HTTP Server
• Resolved in Puppet Enterprise 3.8.2
• CVE-2014-6272 – Potential Heap Overflow Vulnerability in Libevent
• Resolved in Puppet Enterprise 3.8.2
• Oracle Java July 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.2 and 2015.2.0
• cURL June 2015 Security Fixes
• Resolved in Puppet Enterprise 2015.2.0
• CVE-2015-5686 – Console XSS Vulnerability
• Resolved in Puppet Enterprise 2015.2.0
• CVE-2015-4000 – Logjam TLS Vulnerability
• Resolved in Puppet Enterprise 3.8.1
• OpenSSL June 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.1
• Resolved in Puppet-Agent 1.1.1
• PostgreSQL May 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.1
• Apache ActiveMQ February 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.1
• CVE-2015-4100 – Puppet Enterprise Certificate Authority Reverse Proxy Vulnerability
• Resolved in Puppet Enterprise 3.8.1
• CVE-2015-3900, CVE-2015-4020 – Request Hijacking Vulnerability in RubyGems
• Resolved in Puppet Enterprise 3.8.1
• Resolved in Puppet Agent 1.1.1
• Resolved in Razor Server 1.0.1
• CVE-2015-1855 – Ruby OpenSSL Hostname Verification
• Resolved in Puppet Enterprise 3.8.0
• Resolved in Puppet-Agent 1.0.1
• CVE-2014-9130 – LibYAML vulnerability could allow denial of service
• Resolved in Puppet Enterprise 3.8.0
• Oracle Java April 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.0
• OpenSSL March 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.0
• CWE-352 – Cross-Frame Scripting (XFS) Vulnerability in Puppet Enterprise Console
• Resolved in Puppet Enterprise 3.8.0
• PostgreSQL February 2015 Security Fixes
• Resolved in Puppet Enterprise 3.8.0
• OpenSSL January 2015 Security Fixes
• Resolved in Puppet Enterprise 3.7.2
• Oracle Java January 2015 Security Fixes
• Resolved in Puppet Enterprise 3.7.2
• CVE-2015-1426 – Potential sensitive information leakage in Facter’s Amazon EC2 metadata facts handling
• Resolved in Puppet Enterprise 3.7.2, Facter 2.4.1, CFacter 0.3.0
• CVE-2014-9568 – Potential information leakage in puppetlabs-rabbitmq facts handling
• Resolved in puppetlabs-rabbitmq 5.0
• CVE-2015-1029 – Vulnerability in puppetlabs-stdlib module fact cache
• Resolved in puppetlabs-stdlib 4.5.1
• CVE-2014-9355 – Information Leakage in Puppet Enterprise Console
• Resolved in Puppet Enterprise 3.7.1
• CVE-2014-7818 and CVE-2014-7829 – Rails Action Pack Vulnerabilities
• Resolved in Puppet Enterprise 3.7.1
• OpenSSL October 2014 Security Fixes
• Resolved in Puppet Enterprise 3.7.0
• Oracle Java October 2014 Security Fixes
• Resolved in Puppet Enterprise 3.7.0
• CVE-2014-3566 – POODLE SSLv3 Vulnerability
• Resolved in Puppet Enterprise 3.7.0
• Manual remediation available for Puppet Enterprise 3.3
• Resolved in Puppet 3.7.2, Puppet-Server 0.3.0, PuppetDB 2.2, MCollective 2.6.1
• Puppet Forge October 2014 Vulnerability Fix
• Resolved in Puppet Forge
• CVE-2014-7170 – Puppet Server local information leakage
• Resolved in Puppet Server 0.2.1
• OpenSSL August 2014 Vulnerability Fix
• Resolved in Puppet Enterprise 2.8.8, 3.3.2
• CVE-2014-0226 – Apache vulnerability in mod_status module could allow arbitrary code execution
• Resolved in Puppet Enterprise 2.8.8, 3.3.2
• CVE-2014-0118 – Apache vulnerability in mod_deflate module could allow denial of service attacks
• Resolved in Puppet Enterprise 2.8.8, 3.3.2
• CVE-2014-0231 – Apache vulnerability in mod_cgid module could allow denial of service attacks
• Resolved in Puppet Enterprise 2.8.8, 3.3.2
• Oracle Java July 2014 Vulnerability Fix
• Resolved in Puppet Enterprise 3.3.1
• CVE-2014-0198 – OpenSSL vulnerability could allow denial of service attack
• Resolved in Puppet Enterprise 3.3.0
• CVE-2014-0224 – OpenSSL vulnerability in secure communications
• Resolved in Puppet Enterprise 3.3.0
• CVE-2014-3251 – MCollective ‘aes_security’ plugin vulnerability
• Resolved in Puppet Enterprise 3.3.0, Mcollective 2.5.3
• CVE-2014-3248 – Arbitrary Code Execution with Required Social Engineering
• Resolved in Puppet Enterprise 2.8.7, Puppet 2.7.26, 3.6.2, Facter 2.0.2, Hiera 1.3.4, Mcollective 2.5.2
• CVE-2014-3249 – Information leakage in Puppet Enterprise Console
• Resolved in Puppet Enterprise 2.8.7
• CVE-2014-3250 – Information Leakage Vulnerability
• Resolved in Puppet 3.6.2
• Puppet Enterprise not affected
• Oracle Java April 2014 Vulnerability Fix
• Resolved in Puppet Enterprise 3.2.3
• CVE-2014-2525 – LibYAML vulnerability could allow arbitrary code execution in a URI in a YAML file
• Resolved in Puppet Enterprise 3.2.2
• CVE-2014-0098 – Apache vulnerability in config module could allow denial of service attacks via cookies
• Resolved in Puppet Enterprise 3.2.2, 2.8.6
• CVE-2013-6438 – Apache vulnerability in `mod_dav` module could allow denial of service attacks via DAV WRITE requests
• Resolved in Puppet Enterprise 3.2.2, 2.8.6
• CVE-2014-0082 – ActionView vulnerability in Ruby on Rails
• Resolved in Puppet Enterprise 3.2.0
• CVE-2014-0060 – PostgreSQL security bypass vulnerability
• Resolved in Puppet Enterprise 3.2.0
• CVE-2013-4971 – Unathenticated read access to node endpoints could cause information leakage
• Resolved in Puppet Enterprise 3.2.0
• CVE-2013-4966 – Master external node classification script vulnerable to console impersonation.
• Resolved in Puppet Enterprise 3.2.0
• CVE-2013-6393 – Potential denial of service (daemon crash) or arbitrary code execution via libyaml
• Resolved in Puppet Enterprise 3.1.3
• CVE-2013-6450 – Potential denial of service (daemon crash) via crafted traffic from a TLS 1.2 client
• Resolved in Puppet Enterprise 3.1.2
• CVE-2013-6417 – Improper consideration of differences in parameter handling between Rack and Rails Requests
• Resolved in Puppet Enterprise 2.8.4, 3.1.1
• CVE-2013-6415 – Cross-site scripting (XSS) vulnerability in Ruby on Rails
• Resolved in Puppet Enterprise 2.8.4, 3.1.1
• CVE-2013-6414 – Action View vulnerability in Ruby on Rails
• Resolved in Puppet Enterprise 3.1.1
• CVE-2013-4969 – Unsafe use of temp files in File type
• Resolved in Puppet 3.4.1, Puppet Enterprise 2.8.4, 3.1.1
• CVE-2013-4491 – XSS vulnerability in Ruby on Rails
• Resolved in Puppet Enterprise 3.1.1
• CVE-2013-4363 – Algorithmic Complexity Vulnerability in RubyGems
• Resolved in Puppet Enterprise 2.8.4, 3.1.1
• CVE-2013-4164 – Heap overflow in floating point parsing in Ruby
• Resolved in Puppet Enterprise 2.8.4, 3.1.1
• CVE-2013-4965 – Console user account brute force vulnerability
• Resolved in Puppet Enterprise 3.1.0
• CVE-2013-4957 – Puppet Dashboard Report YAML Handling Vulnerability
• Resolved in Puppet Enterprise 3.1.0
• CVE-2013-4287 – Rubygems Algorithmic Complexity DOS Vulnerability
• Resolved in Puppet Enterprise 3.1.0
• CVE-2013-4968 – Site Lacked Clickjacking Defense
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4967 – External Node Classifiers Allowed Clear Text Database Password Query
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4964 – Session Cookies Not Set With Secure Flag
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4963 – Cross-Site Request Forgery Vulnerability
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4962 – Lack of Reauthentication for Sensitive Transactions
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4961 – Software Version Numbers Were Revealed
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4959 – Sensitive Data Browser Caching
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4958 – Lack of Session Timeout
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4956 – Puppet Module Permissions Vulnerability
• Resolved in Puppet 2.7.23, 3.2.4, Puppet Enterprise 2.8.3, 3.0.1
• CVE-2013-4955 – Phishing Through URL Redirection Vulnerability
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4762 – Logout Link Did Not Destroy Server Session
• Resolved in Puppet Enterprise 3.0.1
• CVE-2013-4761 – `resource_type` Remote Code Execution Vulnerability
• Resolved in Puppet 2.7.23, 3.2.4, Puppet Enterprise 2.8.3, 3.0.1
• CVE-2013-4073 – Ruby SSL Vulnerability
• Resolved in Puppet Enterprise 2.8.3, 3.0.1
• CVE-2013-3567 – Unauthenticated Remote Code Execution Vulnerability
• Resolved in Puppet 2.7.22, 3.2.2, Puppet Enterprise 2.8.2
• CVE-2013-2716 – CAS Client Config Vulnerability
• Resolved in Puppet Enterprise 2.8.0
• CVE-2013-2275 – Incorrect Default Report ACL Vulnerability
• Resolved in Puppet 2.6.18, 2.7.21, 3.1.1, Puppet Enterprise 1.2.7, 2.7.2
• CVE-2013-2274 – Remote Code Execution Vulnerability
• Resolved in Puppet 2.6.18, Puppet Enterprise 1.2.7
• CVE-2013-2065 – Object taint bypassing in DL and Fiddle in Ruby
• Resolved in Puppet Enterprise 3.1.0
• CVE-2013-1655 – Unauthenticated Remote Code Execution Vulnerability
• Resolved in Puppet 2.7.21, 3.1.1
• CVE-2013-1654 – SSL Protocol Downgrade Vulnerability
• Resolved in Puppet 2.6.18, 2.7.21, 3.1.1, Puppet Enterprise 1.2.7, 2.7.2
• CVE-2013-1653 – Agent Remote Code Execution Vulnerability
• Resolved in Puppet 2.7.21, 3.1.1, Puppet Enterprise 2.7.2
• CVE-2013-1652 – Insufficient Input Validation Vulnerability
• Resolved in Puppet 2.6.18, 2.7.21, 3.1.1, Puppet Enterprise 1.2.7, 2.7.2
• CVE-2013-1640 – Remote Code Execution Vulnerability
• Resolved in Puppet 2.6.18, 2.7.21, 3.1.1, Puppet Enterprise 1.2.7, 2.7.2
• CVE-2013-0277 – Rails (ActiveRecord) YAML Serialization Vulnerability
• Puppet Enterprise Hotfixes for Puppet Enterprise 1.2.6, and 2.7.1
• CVE-2013-0269 – JSON Unsafe Object Creation Vulnerability
• Puppet Enterprise Hotfixes for Puppet Enterprise 1.2.6, and 2.7.1
• CVE-2013-0263 – Rack Timing Attack Vulnerability
• Puppet Enterprise Hotfixes for Puppet Enterprise 1.2.6, and 2.7.1
• CVE-2013-0169 – OpenSSL Lucky Thirteen Vulnerability
• Puppet Enterprise Hotfixes for Puppet Enterprise 1.2.6, and 2.7.1
• CVE-2013-1399 – Console CSRF Vulnerability
• Resolved in Puppet Enterprise 2.7.1
• CVE-2013-1398 – MCO Private Key Leak
• Resolved in Puppet Enterprise 2.7.1
• CVE-2013-0333 – Rails JSON Parser Vulnerability
• Puppet Enterprise Hotfixes for Puppet Enterprise 1.2.5, and 2.7.0
• CVE-2013-0155 – Rails (ActiveRecord) Unsafe Query Generation Risk
• Puppet Enterprise Hotfixes for Puppet Enterprise 1.2.5, and 2.7.0
• CVE-2013-0156 – Rails (ActionPack) SQL Injection Vulnerability
• Puppet Enterprise Hotfixes for Puppet Enterprise 1.2.5, and 2.7.0
• CVE-2012-5664 – Rails (ActiveRecord) SQL Injection Vulnerability
• Puppet Enterprise Hotfixes for Puppet Enterprise 1.2.5, and 2.7.0
• CVE-2012-5158 – Incorrect Session Handling
• Resolved in Puppet Enterprise 2.6.1
• CVE-2012-3864 – Arbitrary File Read
• Resolved in Puppet 2.6.17, 2.7.18, Puppet Enterprise Hotfixes for 1.0, 1.1, 1.2.x, and 2.0.x, Puppet Enterprise 2.5.2
• CVE-2012-3865 – Arbitrary file delete/D.O.S on Puppet Master
• Resolved in Puppet 2.6.17, 2.7.18, Puppet Enterprise Hotfixes for 1.0, 1.1, 1.2.x, and 2.0.x, Puppet Enterprise 2.5.2
• CVE-2012-3866 – last_run_report.yaml is World-Readable
• Resolved in Puppet 2.7.18, Puppet Enterprise Hotfixes for 2.0.x, Puppet Enterprise 2.5.2
• CVE-2012-3867 – Insufficient Input Validation
• Resolved in Puppet 2.6.17, 2.7.18, Puppet Enterprise Hotfixes for 1.0, 1.1, 1.2.x, and 2.0.x, Puppet Enterprise 2.5.2
• CVE-2012-3408 – Agent Impersonation
• Addressed in 2.7.18, Puppet Enterprise Hotfixes for 2.0.x, Puppet Enterprise 2.5.2
• CVE-2012-1906 – Arbitrary Code Execution
• Resolved in Puppet 2.6.15, 2.7.13, Puppet Enterprise Hotfixes for 1.0, 1.1, 1.2.x, and 2.0.x, Puppet Enterprise 2.5.1
• CVE-2012-1986 – Arbitrary File Read
• Resolved in Puppet 2.6.15, 2.7.13, Puppet Enterprise Hotfixes for 1.0, 1.1, 1.2.x, and 2.0.x, Puppet Enterprise 2.5.1
• CVE-2012-1987 – Denial of Service
• Resolved in Puppet 2.6.15, 2.7.13, Puppet Enterprise Hotfixes for 1.0, 1.1, 1.2.x, and 2.0.x, Puppet Enterprise 2.5.1
• CVE-2012-1988 – Arbitrary Code Execution
• Resolved in Puppet 2.6.15, 2.7.13, Puppet Enterprise Hotfixes for 1.0, 1.1, 1.2.x, and 2.0.x, Puppet Enterprise 2.5.1
• CVE-2012-1989 – Arbitrary File Write
• Resolved in Puppet 2.7.13, Puppet Enterprise 2.5.1, Puppet Enterprise Hotfixes for 2.0.x; not applicable to earlier versions
• CVE-2012-1053 – Puppet Resource Local Group Privilege Escalation
• Resolved in Puppet 2.6.14, 2.7.11, Puppet Enterprise Hotfixes for 1.0, 1.1 and 1.2.x, Puppet Enterprise 2.0.3
• CVE-2012-1054 – K5login Local User Privilege Escalation
• Resolved in Puppet 2.6.14, 2.7.11, Puppet Enterprise Hotfixes for 1.0, 1.1 and 1.2.x, Puppet Enterprise 2.0.3
• CVE-2012-0891 – Dashboard Cross Site Scripting (XSS) Vulnerability
• Resolved in Puppet Dashboard 1.2.5, Puppet Enterprise Hotfixes for 1.0, 1.1 and 1.2.x, Puppet Enterprise 2.0.1
• CVE-2011-3872 – AltNames Vulnerability
• Resolved in Puppet 0.25.6, 2.6.12, 2.7.6, Puppet Enterprise 1.2.4
• CVE-2011-3871 – Puppet Resource Local Privilege Escalation
• Resolved in 2.7.5 and 2.6.11, Puppet Enterprise 1.2.3
• CVE-2011-3870 – SSH Auth Key Local Privilege Escalation
• Resolved in 2.7.5 and 2.6.11, Puppet Enterprise 1.2.3
• CVE-2011-3869 – K5login Local Privilege Escalation
• Resolved in 2.7.5 and 2.6.11, Puppet Enterprise 1.2.3
• CVE-2011-3848 – Directory Traversal Write Vulnerability
• Resolved in Puppet 2.7.4 and 2.6.10, Puppet Enterprise 1.2.2
• auth-conf-2010-10 – Missing Auth.conf Resource Manipulation
• Resolved in Puppet 2.6.4
• CVE-2010-0156 – File overwrite vulnerability via symlink attack
• Resolved in Puppet 0.25.2, 0.24.9
• CVE-2009-3564 – Failure to reset supplementary groups
• Resolved in Puppet 0.25.2