ADVISORIES

• CVE-2023-5214 (NVD)
• GHSA-289m-2964-f8q5
• Vendor Advisory

GEM

bolt

SEVERITY

CVSS v3.x: 9.8 (Critical)

PATCHED VERSIONS

• >= 3.27.4

DESCRIPTION

In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.

RELATED

• https://nvd.nist.gov/vuln/detail/CVE-2023-5214
• https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-bolt
• https://yanac.hu/2023/10/07/cve-2023-5214-puppetlabs-puppet-bolt-up-to-3-27-3-privileges-management
• https://github.com/advisories/GHSA-289m-2964-f8q5