CVE-2016-2786

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-2786
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2786.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-2786
Published
2016-06-10T15:59:01.343Z
Modified
2026-04-10T03:49:15.272858Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.

References

Affected packages

Git / github.com/puppetlabs/puppet-agent

Affected ranges

Type
GIT
Repo
https://github.com/puppetlabs/puppet-agent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2c15cafc29981375f8784fbd61c71a17e8bc90f0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0780d7fd43038b45dc99dc146de1f35ef2d51944
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.3.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.3.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/puppetlabs/puppetlabs-puppet_agent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c6ab0483ab258a1241a66cb9d9cd5419357cbc60
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
86328dc6014bac7c9a5f01dbd0624190c731e318
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fd43dc466e1f72f6c3d6d58159aadaf9b8847b68
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.3.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.3.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.3.2"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.3
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.2
1.*
1.0.0
1.1.0
1.2.0
1.2.7
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2786.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2015.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2015.3.2"
            }
        ]
    }
]