CVE-2017-2298

State: Published
Severity: Not scored
Published: Jun 30, 2017
Updated: Sep 16, 2024
Reserved: Dec 1, 2016

Description

The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to write a file to an arbitrary location on the client with the filename appended with the string "_pub.pem".

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
mcollectivePuppet	< 0.5.1Affected

References

https://github.com/puppetlabs/mcollective-sshkey-security/blob/0.5.1/CHANGELOG.md
https://puppet.com/security/cve/cve-2017-2298
https://github.com/puppetlabs/mcollective-sshkey-security/commit/3388a3109f4fb1c69fa8505e991bf59ca20d19a2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.