by Kastro
Paper/Archive/CVE-2022-3275

CVE-2022-3275

Puppet puppetlabs-apt — Puppetlabs-apt Command Injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.8.838 × 2016.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.

Affected

ProductAffectedFixed inSource
puppetlabs-aptunspecified – < 9.0.09.0.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
puppet (CNA)8.4CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refpuppet.com/security/cve/CVE-2022-3275advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR5LIOF5VKS4DC2NQWXTMPPXOYJC46XCadvisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CH4NUKZKPY4MFQHFBTONJK2AWES4DFDA