What’s Vulnerable › Vulnerabilities

CVE-2017-2296

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-02-01 · updated 2026-06-17
• Weakness: CWE-20

Description

In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2.

Affected products

• Puppet Enterprise: 2017.1.0, 2017.1.1, 2017.2.1

References

• https://puppet.com/security/cve/cve-2017-2296
• https://puppet.com/security/cve/cve-2017-2296

Get alerted when CVE-2017-2296 or the next vulnerability affects your stack