CVE catalog

CVE-2018-6508

puppet-module-puppetlabs-apache: CVE-2018-6508

[CVE catalog]

Severity
Critical · CVSS 9CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.87% · Oct 25, 2026

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpuppet-module-puppetlabs-aptsid9.4.0-1fixed
Debianpuppet-module-puppetlabs-aptforky9.4.0-1fixed
Debianpuppet-module-puppetlabs-apttrixie9.4.0-1fixed
Debianpuppet-module-puppetlabs-aptbookworm9.0.1-1fixed
Debianpuppet-module-puppetlabs-mysqlsid15.0.0-4fixed
Debianpuppet-module-puppetlabs-mysqlforky15.0.0-4fixed
Debianpuppet-module-puppetlabs-mysqltrixie15.0.0-3fixed
Debianpuppet-module-puppetlabs-mysqlbookworm8.1.0-7fixed
Debianpuppet-module-puppetlabs-apachesid12.2.0-2fixed
Debianpuppet-module-puppetlabs-apachetrixie12.2.0-1fixed
Debianpuppet-module-puppetlabs-apachebookworm5.5.0-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpuppet-module-puppetlabs-aptsourcesid4.5.1-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-aptsourceforky4.5.1-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-aptsourcetrixie4.5.1-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-aptsourcebookworm4.5.1-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-mysqlsourcesid5.3.0-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-mysqlsourceforky5.3.0-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-mysqlsourcetrixie5.3.0-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-mysqlsourcebookworm5.3.0-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-apachesourcesid3.0.0-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-apachesourcetrixie3.0.0-1unimportantNot reportedNot reported
Debianpuppet-module-puppetlabs-apachesourcebookworm3.0.0-1unimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [puppet-module-puppetlabs-apache]Fixed
    Details (2)

    • 5.5.0-2 · all · bookworm

      Fixed · Fixed: 3.0.0-1

      dsa · puppet-module-puppetlabs-apache · debian · bookworm; dsa · puppet-module-puppetlabs-apache · debian · 12

    • 5.5.0-2 · all · bookworm

      Fixed · Fixed: 3.0.0-1

      dsa · puppet-module-puppetlabs-apache · debian · bookworm; dsa · puppet-module-puppetlabs-apache · debian · 12

  • [puppet-module-puppetlabs-apt]Fixed
    Details (2)

    • 9.0.1-1 · all · bookworm

      Fixed · Fixed: 4.5.1-1

      dsa · puppet-module-puppetlabs-apt · debian · bookworm; dsa · puppet-module-puppetlabs-apt · debian · 12

    • 9.0.1-1 · all · bookworm

      Fixed · Fixed: 4.5.1-1

      dsa · puppet-module-puppetlabs-apt · debian · bookworm; dsa · puppet-module-puppetlabs-apt · debian · 12

  • [puppet-module-puppetlabs-mysql]Fixed
    Details (2)

    • 8.1.0-7 · all · bookworm

      Fixed · Fixed: 5.3.0-1

      dsa · puppet-module-puppetlabs-mysql · debian · bookworm; dsa · puppet-module-puppetlabs-mysql · debian · 12

    • 8.1.0-7 · all · bookworm

      Fixed · Fixed: 5.3.0-1

      dsa · puppet-module-puppetlabs-mysql · debian · bookworm; dsa · puppet-module-puppetlabs-mysql · debian · 12

[Debian 13 (Trixie)]

  • [puppet-module-puppetlabs-apache]Fixed
    Details (2)

    • 12.2.0-1 · all · trixie

      Fixed · Fixed: 3.0.0-1

      dsa · puppet-module-puppetlabs-apache · debian · 13

    • 12.2.0-1 · all · trixie

      Fixed · Fixed: 3.0.0-1

      dsa · puppet-module-puppetlabs-apache · debian · 13

  • [puppet-module-puppetlabs-apt]Fixed
    Details (2)

    • 9.4.0-1 · all · trixie

      Fixed · Fixed: 4.5.1-1

      dsa · puppet-module-puppetlabs-apt · debian · 13

    • 9.4.0-1 · all · trixie

      Fixed · Fixed: 4.5.1-1

      dsa · puppet-module-puppetlabs-apt · debian · 13

  • [puppet-module-puppetlabs-mysql]Fixed
    Details (2)

    • 15.0.0-3 · all · trixie

      Fixed · Fixed: 5.3.0-1

      dsa · puppet-module-puppetlabs-mysql · debian · 13

    • 15.0.0-3 · all · trixie

      Fixed · Fixed: 5.3.0-1

      dsa · puppet-module-puppetlabs-mysql · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]