5

CVE-2013-1654

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.

Data is provided by the National Vulnerability Database (NVD)
Puppet ≫ Puppet Version2.7.2
Puppet ≫ Puppet Version2.7.3
Puppet ≫ Puppet Version2.7.4
Puppet ≫ Puppet Version2.7.5
Puppet ≫ Puppet Version2.7.6
Puppet ≫ Puppet Version2.7.7
Puppet ≫ Puppet Version2.7.8
Puppet ≫ Puppet Version2.7.9
Puppet ≫ Puppet Version2.7.10
Puppet ≫ Puppet Version2.7.11
Puppet ≫ Puppet Version2.7.12
Puppet ≫ Puppet Version2.7.13
Puppet ≫ Puppet Version2.7.14
Puppet ≫ Puppet Version2.7.16
Puppet ≫ Puppet Version2.7.17
Puppet ≫ Puppet Version2.7.18
Puppetlabs ≫ Puppet Version2.7.0
Puppetlabs ≫ Puppet Version2.7.1
Puppetlabs ≫ Puppet Version2.7.19
Puppetlabs ≫ Puppet Version2.7.20
Puppetlabs ≫ Puppet Version2.7.20 Updaterc1
Puppet ≫ Puppet Enterprise Version3.1.0
Puppetlabs ≫ Puppet Version2.7.0 Update- Editionenterprise
Puppetlabs ≫ Puppet Version2.7.1 Update- Editionenterprise
Canonical ≫ Ubuntu Linux Version11.10
Canonical ≫ Ubuntu Linux Version12.04 Update- Editionlts
Canonical ≫ Ubuntu Linux Version12.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.51% 0.655
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N