CVE-2013-1398

Overview

CVE-2013-1398 (MCO Private Key Leak)

  • Posted February 6, 2013

    • Under certain circumstances, a user with root access to a single node in a PE deployment could possibly manipulate that client's local facts in order to force the pe_mcollective module to deliver a catalog containing SSL keys. These keys could be used to access other nodes in the collective and send them arbitrary commands as root. For the vast majority of users, the fix is to apply the 2.7.1 upgrade. For PE users who do not use the Console, this can be fixed by making sure that the `pe_mcollective::role::master` class is applied to your master, and the pe_mcollective::role::console class is applied to your console. This can be as simple as adding the following to your site.pp manifest or other node classifier: 
    node console {
  include pe_mcollective::role::console
}

node master {
  include pe_mcollective::role::master
}
    This vulnerability affects the master role of Puppet Enterprise.

    Status

    • Resolved in Puppet Enterprise 2.7.1