Bug 983729 (CVE-2016-2786) - VUL-0: CVE-2016-2786: puppet: Incorrect Client Verification in Puppet Communications Protocol
Summary: VUL-0: CVE-2016-2786: puppet: Incorrect Client Verification in Puppet Communi...
Status: RESOLVED UPSTREAM
Alias: CVE-2016-2786
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Kristyna Streitova
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/169824/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-06-08 11:34 UTC by Marcus Meissner
Modified: 2016-10-19 12:25 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2016-06-08 11:34:37 UTC 
CVE-2016-2786

https://puppet.com/security/cve/CVE-2016-2786

CVE-2016-2786 - Incorrect Client Verification in Puppet Communications Protocol
Overview

    Posted March 14, 2016
    Assessed Risk Level: High

The Puppet Communications Protocol included in Puppet Enterprise 2015.3 does not properly validate certificates in all cases. This potentially allows for arbitrary remote code execution on Puppet agent nodes.

In PE 2015.3.2 and earlier, the pxp-agent component does not properly validate the server certificate. This makes it possible for an attacker to impersonate a broker and issue commands to the agent, assuming the attacker can force the agent to connect to an arbitrary broker via a secondary attack (DNS spoofing, etc).

Default configurations of FOSS Puppet Agent are not vulnerable.
Status:

Affected Software Versions:

    Puppet Enterprise 2015.3.x prior to 2015.3.3
    Puppet Agent 1.3.x

Resolved in:

    Puppet Enterprise 2015.3.3
    Puppet Agent 1.3.6
Comment 1 Marcus Meissner 2016-06-08 11:42:28 UTC 
we ship the foss agent, not sure what they mean with default configuration is not affected there. 

I am guessing we are good, but can you cross check perhaps?
Comment 2 Swamp Workflow Management 2016-06-08 22:02:24 UTC 
bugbot adjusting priority
Comment 3 Kristyna Streitova 2016-10-07 16:24:16 UTC 
(In reply to Marcus Meissner from comment #1)
> I am guessing we are good, but can you cross check perhaps?

According to [1], affected Puppet Enterprise 2015.3.x and Puppet Agent 1.3.x contain Puppet 4.3.x that we don't ship. It seems that we are not affected by this issue.

[1] https://docs.puppet.com/pe/latest/overview_version_table.html
Comment 5 Marcus Meissner 2016-10-19 12:25:43 UTC 
does not affect us apparently.