Description
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.
References (8)
Core 8
Core References
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0710.html
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2013/dsa-2643
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/52596
Various Sources vendor-advisory
x_refsource_ubuntu
http://ubuntu.com/usn/usn-1759-1
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
Vendor Advisory x_refsource_confirm
https://puppetlabs.com/security/cve/cve-2013-1654/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/64758
Scores
EPSS
0.0295
EPSS Percentile
85.6%
Details
Status
published
Products (24)
canonical/ubuntu_linux
11.10
canonical/ubuntu_linux
12.04
canonical/ubuntu_linux
12.10
puppet/puppet
2.7.2
puppet/puppet
2.7.3
puppet/puppet
2.7.4
puppet/puppet
2.7.5
puppet/puppet
2.7.6
puppet/puppet
2.7.7
puppet/puppet
2.7.8
... and 14 more
Published
Mar 20, 2013
Tracked Since
Feb 18, 2026