CVE-2014-3251

Severity: medium (CVSS 4.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-12 · updated 2026-06-17
Weakness: CWE-362

Description

The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.

Affected products

Puppet Enterprise: through 3.2.0
Puppetlabs Mcollective: all versions

References

http://puppetlabs.com/security/cve/cve-2014-3251
http://secunia.com/advisories/59356
http://secunia.com/advisories/60066
http://www.osvdb.org/109257
http://puppetlabs.com/security/cve/cve-2014-3251
http://secunia.com/advisories/59356
http://secunia.com/advisories/60066
http://www.osvdb.org/109257

Get alerted when CVE-2014-3251 or the next vulnerability affects your stack