CVE-2015-1426 Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata
Local attackers can read sensitive Amazon EC2 IAM instance metadata via Puppet Facter, exposing credentials and configuration data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1426?
CVE-2015-1426 is a low-severity vulnerability in n/a, published on 23 Feb 2015. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Weakness: CWE-200
Which versions are affected by CVE-2015-1426?
2 open source packages ship an affected version, including facter. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
facter RubyGems | From 1.6.0 | 2.4.1 |
facter RubyGems | From 1.6.0 | 2.4.1 |
Products include Puppet Facter, Puppetlabs Facter.
How do I fix CVE-2015-1426?
Upgrade facter to 2.4.1 or later.
Is CVE-2015-1426 being exploited?
There is no known exploitation of CVE-2015-1426 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2015-1426, GHSA-j436-h7hm-rx46, UBUNTU-CVE-2015-1426.