CVE-2014-3251

Description

The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.

References

http://www.osvdb.org/109257

http://secunia.com/advisories/60066

http://secunia.com/advisories/59356

http://puppetlabs.com/security/cve/cve-2014-3251

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3