Bug 1365807 (CVE-2015-7331) - CVE-2015-7331 mcollective-puppet-agent: Remote Code Execution in mcollective-puppet-agent plugin
Summary: CVE-2015-7331 mcollective-puppet-agent: Remote Code Execution in mcollective-...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-7331
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1374964
Blocks: 1365813
TreeView+ depends on / blocked
 
Reported: 2016-08-10 09:03 UTC by Andrej Nemec
Modified: 2021-02-17 03:27 UTC (History)
9 users (show)

Fixed In Version: mcollective-puppet-agent 1.11.1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-09-11 02:10:44 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2016-08-10 09:03:51 UTC 
A vulnerability was found in puppet-agent MCollective plugin. It previously allowed you to pass the '--server' argument to MCollective. This insecure argument enabled remote code execution via connection to an untrusted host.

External References:

https://puppet.com/security/cve/cve-2015-7331
Note You need to log in before you can comment on or make changes to this bug.