AZL-112717
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112717.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-112717
- Upstream
- CVE-2026-115731
- Published
- 2026-11-03T21:17:01Z
- Modified
- 2026-11-07T14:17:58Z
- Summary
- CVE-2026-115731 affecting package puppet 7.34.0-1
- Details
-
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.
- References