How many CVEs have patched Puppet?

3 published CVEs changed Puppet in puppetlabs/puppet, in 11 distinct patches totalling 80 changed lines, between 2012 and 2016.

What is the latest CVE that changed Puppet?

CVE-2016-2785 (Puppet Improper Access Control), published 2016-06-10, changed lines 5 of lib/puppet/network/http/rack/rest.rb.

How does Puppet compare to the rest of puppetlabs/puppet?

puppetlabs/puppet has 15 CVEs with a located fix in total; 3 of them changed Puppet.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

RadicalNotion.AI

Log in Create an account

puppetlabs/puppet

Class

7 files

Puppet

Name: Puppet in puppetlabs/puppet: CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Defined in 7 files

Last patched June 10, 2016

3

CVEs

That changed this function

11

Distinct patches

Backports counted once

80

Lines changed

Added plus removed

2012–2016

Years

By CVE publication date

Overview

Puppet in puppetlabs/puppet was changed by 3 published CVE fixes between 2012 and 2016, in 11 distinct patches that added or removed 80 lines in total.

The name occurs in 7 files: lib/puppet/defaults.rb, lib/puppet/file_serving/metadata.rb, lib/puppet/indirector/file_content/selector.rb, lib/puppet/network/http/rack/rest.rb, lib/puppet/file_serving/terminus_selector.rb, lib/puppet/file_serving/content.rb, lib/puppet/indirector/file_metadata/selector.rb.

puppetlabs/puppet has 15 CVEs with a located fix in total, so 20% of them touched this function.

CVEs that patched it

Every published CVE whose fix changed Puppet, newest first, with the lines each fix touched.

Puppet Improper Access Control
CVE-2016-2785 · lib/puppet/network/http/rack/rest.rb · line 5 · +1 −0
Critical · CVSS 9.8
EPSS 2.9%2016-06-10
Puppet allows local users to obtain sensitive configuration information
CVE-2012-3866 · lib/puppet/defaults.rb · lines 602–720 · +4 −4 in 2 hunks
Low · CVSS 2.1
EPSS 0.5%2012-08-06
CVE-2012-3864
CVE-2012-3864 · lib/puppet/file_serving/content.rb · lines 8–14 · +1 −2
Medium · CVSS 4.0
EPSS 1.9%2012-08-06
CVE-2012-3864
CVE-2012-3864 · lib/puppet/file_serving/metadata.rb · lines 10–17 · +1 −2 in 2 hunks
Medium · CVSS 4.0
EPSS 1.9%2012-08-06
CVE-2012-3864
CVE-2012-3864 · lib/puppet/file_serving/terminus_selector.rb · lines 1–9 · +2 −5
Medium · CVSS 4.0
EPSS 1.9%2012-08-06
CVE-2012-3864
CVE-2012-3864 · lib/puppet/indirector/file_content/selector.rb · lines 1–29 · +29 −0
Medium · CVSS 4.0
EPSS 1.9%2012-08-06
CVE-2012-3864
CVE-2012-3864 · lib/puppet/indirector/file_metadata/selector.rb · lines 1–29 · +29 −0
Medium · CVSS 4.0
EPSS 1.9%2012-08-06

Get an alert when the next CVE fix lands in puppetlabs/puppet, with the patched functions.

Monitor puppet CVEs

Other functions in these files

Functions in the same files that CVE fixes also changed.

1pathlib/puppet/network/http/rack/rest.rb1 CVEs · 2 patches2016

Other hotspots in the repository

Functions in puppetlabs/puppet changed by the most CVE fixes.

uri2indirection2 CVEs · lib/puppet/network/http/api/v1.rb path1 CVEs · lib/puppet/network/http/rack/rest.rb compile1 CVEs · lib/puppet/indirector/catalog/compiler.rb uri2indirection1 CVEs · lib/puppet/network/http/api/indirected_routes.rb setup1 CVEs · lib/puppet/application/master.rb split_path1 CVEs · lib/puppet/file_serving/configuration.rb

All patched functions in puppetlabs/puppet

Frequently asked questions

Common questions about CVE fixes to Puppet.

How many CVEs have patched Puppet?: 3 published CVEs changed Puppet in puppetlabs/puppet, in 11 distinct patches totalling 80 changed lines, between 2012 and 2016.
What is the latest CVE that changed Puppet?: CVE-2016-2785 (Puppet Improper Access Control), published 2016-06-10, changed lines 5 of lib/puppet/network/http/rack/rest.rb.
How does Puppet compare to the rest of puppetlabs/puppet?: puppetlabs/puppet has 15 CVEs with a located fix in total; 3 of them changed Puppet.
What do the line numbers refer to?: Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track puppetlabs/puppet CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing