description: Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.
problem types: Remote Code Execution
affected:
{
product: Puppet Enterprise
vendor: Puppet
versions:
status: affected, version: 2017.3.x prior to 2017.3.4
}
{
product: puppetlabs/facter_task
vendor: Puppet
versions:
status: affected, version: prior to 0.1.5
}
{
product: puppetlabs/puppet_conf
vendor: Puppet
versions:
status: affected, version: prior to 0.1.5
}
{
product: puppetlabs/apt
vendor: Puppet
versions:
status: affected, version: prior to 4.5.1
}
{
product: puppetlabs/mysql
vendor: Puppet
versions:
status: affected, version: prior to 5.2.1
}
{
product: puppetlabs/apache
vendor: Puppet
versions:
status: affected, version: prior to 2.3.1
}
