Puppet Enterprise vulnerabilities
3 known vulnerabilities in Puppet Enterprise from Perforce. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.0 Critical severity
Puppet Enterprise: Incorrect Comparison
Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authoriz
- 9.4 Critical severity
Puppet Enterprise: Improper Control of Generation of Code
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by subm
- 8.8 High severity
Puppet Enterprise: Improper Neutralization of Special Elements used in an OS Command
A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versi