Security Advisory

CVE-2017-2298

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2017-06-30 20:00:00

Last updated 2024-09-16 18:08:33

Assigner puppet

CVSS score not scored

State PUBLISHED

Description

The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to write a file to an arbitrary location on the client with the filename appended with the string "_pub.pem".

← Browse all CVEs View on cve.org ↗