6.5med
CVE-2017-2296
In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group n…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 59%
Public exploits
0
none known
Summary
In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2.
Exploit prediction (EPSS)
0.88% probability of exploitation in the next 30 days, higher than 59% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P |
Affected products
- Puppet Puppet Enterprise
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- puppet.com /security/cve/cve-2017-2296 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-2296
- NVD: CVE-2017-2296
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.