Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before
    1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging
    incorrect URL decoding. (CVE-2016-2785)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before     1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging     incorrect URL decoding. (CVE-2016-2785)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201606-02 (Puppet Server and Agent: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Puppet Server and       Agent.  Please review the CVE identifiers referenced below for details.
  Impact :

    Remote attackers, impersonating a trusted broker, could potentially       execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
432260	SCA: security update for puppet (GHSA-pqj5-7r86-64fv)	Tenable Cloud Security	SCA Checks	Local	critical
432260	SCA: security update for puppet (GHSA-pqj5-7r86-64fv)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
219316	Linux Distros Unpatched Vulnerability : CVE-2016-2785	Nessus	Misc.	Local	critical
91479	GLSA-201606-02 : Puppet Server and Agent: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical

Detections

Analytics

CVE-2016-2785

critical

Tenable Plugins

critical

critical

critical

critical