CVE-2018-6512

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-11 · updated 2026-06-17
Weakness: CWE-94

Description

The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise: 2018.1.x versions prior to 2018.1.1 and razor-server and pe-razor-server prior to 1.9.0.0.

Affected products

Puppet Pe-Razor-Server: before 1.9.0.0 — fixed in 1.9.0.0
Puppet Enterprise: from 2018.1.0 before 2018.1.1 — fixed in 2018.1.1
Puppet Razor-Server: before 1.9.0.0 — fixed in 1.9.0.0

How to fix

Upgrade to a fixed version: Puppet Pe-Razor-Server 1.9.0.0; Puppet Enterprise 2018.1.1; Puppet Razor-Server 1.9.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-6512 or the next vulnerability affects your stack