How many CVEs have a located fix in puppetlabs/puppet?

15 published CVEs have a fix traced to functions in puppetlabs/puppet, touching 33 functions across 26 files.

Which function in puppetlabs/puppet has been patched by the most CVEs?

uri2indirection in lib/puppet/network/http/api/v1.rb has been changed by 2 CVE fixes, from 2012 to 2012.

How large is a typical CVE fix in puppetlabs/puppet?

The median fix changes 29 lines. 40% of fixes change 20 lines or fewer, and 60% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

ruby

#381 of 500 repositories

puppetlabs/puppet

Name: puppetlabs/puppet: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix February 9, 2018

15

CVE fixes located

Published CVEs

33

Functions patched

Distinct function sites

26

Files patched

Distinct source files

2010–2018

Years covered

By CVE publication date

Overview

15 published CVEs have a fix traced to functions in puppetlabs/puppet, the earliest published in 2010. Those fixes changed 33 distinct functions across 26 files, in 92 patch hunks.

Among the 500 repositories tracked here, puppetlabs/puppet ranks #381 by the number of CVEs with a located fix.

Most patched functions

Functions in puppetlabs/puppet changed by the most CVE fixes.

Most patched files

Files in puppetlabs/puppet changed by the most CVE fixes.

1lib/puppet/network/http/api/v1.rb2 CVEs · 1 functions
2install.rb1 CVEs · 4 functions
3lib/puppet/util/reference.rb1 CVEs · 3 functions
4lib/puppet/network/authstore.rb1 CVEs · 2 functions
5lib/puppet/network/http/rack/rest.rb1 CVEs · 2 functions
6lib/puppet/application/master.rb1 CVEs · 1 functions
7lib/puppet/application/resource.rb1 CVEs · 1 functions
8lib/puppet/daemon.rb1 CVEs · 1 functions
9lib/puppet/defaults.rb1 CVEs · 1 functions
10lib/puppet/file_serving/configuration.rb1 CVEs · 1 functions

Fix size

How much code a CVE fix in puppetlabs/puppet changes, with backports counted once.

29

Median lines changed

Added plus removed, per CVE

40%

Fixes of 20 lines or fewer

Share of CVE fixes

60%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in puppetlabs/puppet, and the functions each fix changed.

Tarball permission preservation in puppet
CVE-2017-10689pack
Medium · CVSS 5.5
EPSS 0.4%2018-02-09
Puppet Improper Access Control
CVE-2016-2785path compile uri2indirection
Critical · CVSS 9.8
EPSS 2.9%2016-06-10
Puppet does not properly restrict access to node resources
CVE-2011-0528prepare_installation do_configs glob
Medium · CVSS 5.5
EPSS 1.7%2014-02-17
CVE-2012-3864
CVE-2012-3864Puppet setup split_path
Medium · CVSS 4.0
EPSS 1.9%2012-08-06
Pupper does not properly restrict characters in Common Name field of Certificate Signing Request
CVE-2012-3867check_internal_signing_policies
Medium · CVSS 4.3
EPSS 2.5%2012-08-06
Puppet supports use of IP addresses in certnames without warning of potential risks
CVE-2012-3408match munge_name
Low · CVSS 2.6
EPSS 1.6%2012-08-06
Puppet allows local users to obtain sensitive configuration information
CVE-2012-3866Puppet
Low · CVSS 2.1
EPSS 0.5%2012-08-06
Puppet vulnerable to Path Traversal
CVE-2012-3865process
Low · CVSS 3.5
EPSS 1.9%2012-08-06
Puppet Arbitrary Command Execution
CVE-2012-1988uri2indirection
Medium · CVSS 6.0
EPSS 2.6%2012-05-29
Puppet Denial of Service and Arbitrary File Write
CVE-2012-1987uri2indirection
Low · CVSS 3.5
EPSS 2.5%2012-05-29
Puppet Privilege Escallation
CVE-2012-1053change_user
Medium · CVSS 6.9
EPSS 0.4%2012-05-29
Puppet uses predictable filenames, allowing arbitrary file overwrite
CVE-2011-3871main
Medium · CVSS 6.2
EPSS 0.3%2011-10-27

Get an alert for each new puppetlabs/puppet CVE, with the patched functions and AI-written analysis.

Monitor puppet CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

0xJacky/nginx-ui15 CVEs apache/mynewt-nimble15 CVEs cubecart/v615 CVEs debian/busybox15 CVEs debian/libsoup315 CVEs debian/zziplib15 CVEs decolua/9router15 CVEs DSpace/DSpace15 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in puppetlabs/puppet.

How many CVEs have a located fix in puppetlabs/puppet?: 15 published CVEs have a fix traced to functions in puppetlabs/puppet, touching 33 functions across 26 files.
Which function in puppetlabs/puppet has been patched by the most CVEs?: uri2indirection in lib/puppet/network/http/api/v1.rb has been changed by 2 CVE fixes, from 2012 to 2012.
How large is a typical CVE fix in puppetlabs/puppet?: The median fix changes 29 lines. 40% of fixes change 20 lines or fewer, and 60% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track puppetlabs/puppet CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing