CVE-2023-5214: Improper Privilege Management

October 6, 2023 (updated October 10, 2023)

In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.

References

github.com/advisories/GHSA-289m-2964-f8q5
nvd.nist.gov/vuln/detail/CVE-2023-5214
www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates

Code Behaviors & Features

Detect and mitigate CVE-2023-5214 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →