BlogContact SalesTry Puppet 
Search Puppet.com
Why Puppet

Puppet is the industry standard for IT automation.

Modernize, manage and bring your hybrid infrastructure into compliance through Puppet's powerful continuous automation.

Use Cases
Puppet Enterprise LogoGet Puppet Enterprise

First 10 nodes are free!

Products
Pricing & Packaging
Integrations
Custom consulting services

Get up and running quickly with a custom solution that addresses your unique business goals and easily allows for growth as your needs evolve.

Professional services
Support
Open Source Puppet Assist
Your one-stop shop for exclusive tools to enhance your efficiency using Open Source Puppet.
Puppet Forge

Find thousands of component modules built by the community and guidance on using them in your own infrastructure.

EcosystemOpen Source Projects
Community
Contribute
Puppet Compass Logo
Puppet Compass

Puppet Compass is your learning portal for tools and best practices to address common business challenges.

Product Documentation
Resource libraryCustomers
State of DevOps Report

Since launching our first DevOps survey in 2012, we’ve learned a lot about the power of DevOps to transform organizations.

Partners
Featured Partners
Servicenow Logo
Splunk Logo
Tenable Logo
Puppet Events
About Us

Puppet takes the risk out of change. We meet you where you are today and take you where you need to go.

CompanyWorking at Puppet
Press & news
Events
It's our community that makes Puppet great. Connect with Puppet users and employees.

CVE-2015-3900, CVE-2015-4020 - Request Hijacking Vulnerability in RubyGems

  • Posted June 18, 2015

  • Assessed Risk Level: High

A vulnerability in RubyGems versions between 2.0 and 2.4.6 left clients open to a DNS hijack attack. An attacker could exploit this vulnerability to force a client to unknowingly download and install malicious gem content from an attacker-controller gem server.

For more information on the RubyGems vulnerability, refer to the RubyGems.org security announcement.

CVSSv2 Score: 8.3

Vector: AV:N/AC:M/Au:N/C:P/I:C/A:P

Status:

Affected Software Versions:

  • Puppet Enterprise 3.7.x, 3.8.0 (Puppet Server, Razor Server, Windows 64-bit Puppet Agent)
  • Puppet Agent 1.x
  • Puppet 3.7.x, 3.8.x (Windows 64-bit only)
  • Razor Server 1.0 and earlier

Resolved in:

  • Puppet Enterprise 3.8.1
  • Razor Server 1.0.1
  • Puppet Agent 1.1.1
Puppet sites use proprietary and third-party cookies. By using our sites, you agree to our cookie policy.