CVE-2013-1652

MediumCVSS 4.9/10Last modified Jun 16, 2026

Description

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.

Metrics

CVSS 2.0 4.9/10AV:N/AC:M/Au:S/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0710.htmlThird Party Advisory
http://secunia.com/advisories/52596Third Party Advisory, Vendor Advisory
http://ubuntu.com/usn/usn-1759-1Third Party Advisory
http://www.debian.org/security/2013/dsa-2643Third Party Advisory
http://www.securityfocus.com/bid/58443Third Party Advisory, VDB Entry
https://puppetlabs.com/security/cve/cve-2013-1652/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0710.htmlThird Party Advisory
http://secunia.com/advisories/52596Third Party Advisory, Vendor Advisory
http://ubuntu.com/usn/usn-1759-1Third Party Advisory
http://www.debian.org/security/2013/dsa-2643Third Party Advisory
http://www.securityfocus.com/bid/58443Third Party Advisory, VDB Entry
https://puppetlabs.com/security/cve/cve-2013-1652/Vendor Advisory

Timeline

Published: Mar 20, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-16537.1Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening CVE-2013-16545.0Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol be CVE-2013-16557.5Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via v CVE-2013-16564.3Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary co CVE-2013-16597.6VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and VMware ESX 3.5 thro CVE-2013-16614.3VMware ESXi 4.0 through 5.1, and ESX 4.0 and 4.1, does not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-CVE-2013-16626.9vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to CVE-2013-16645.0The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Esse CVE-2013-16655.0The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other pr CVE-2013-16669.8Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro.CVE-2013-16677.5The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and cr CVE-2013-16688.5The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell meta