{"id":"CVE-2016-2786","details":"The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.","modified":"2026-07-08T05:48:11.021197175Z","published":"2016-06-10T15:59:01.343Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"2015.3.0"},{"last_affected":"2015.3.0"},{"introduced":"2015.3.2"},{"last_affected":"2015.3.2"}],"source":"CPE_STRING","vendor_product":"puppet:puppet_enterprise","cpes":["cpe:2.3:a:puppet:puppet_enterprise:2015.3.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_enterprise:2015.3.2:*:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://puppet.com/security/cve/CVE-2016-2786"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201606-02"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/puppetlabs/puppet-agent","events":[{"introduced":"fe749a8b064afa356c145c2549df606f7cfd98c9"},{"last_affected":"0780d7fd43038b45dc99dc146de1f35ef2d51944"}],"database_specific":{"cpe":["cpe:2.3:a:puppet:puppet_agent:1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_agent:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_agent:1.3.2:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_agent:1.3.4:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_agent:1.3.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.3.0"},{"last_affected":"1.3.0"},{"introduced":"1.3.1"},{"last_affected":"1.3.1"},{"introduced":"1.3.2"},{"last_affected":"1.3.2"},{"introduced":"1.3.4"},{"last_affected":"1.3.4"},{"introduced":"1.3.5"},{"last_affected":"1.3.5"}],"source":"CPE_STRING"}}],"versions":["1.3.0","1.3.1","1.3.2","1.3.4","1.3.5","1.3.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2786.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/puppetlabs/puppetlabs-puppet_agent","events":[{"introduced":"c6ab0483ab258a1241a66cb9d9cd5419357cbc60"},{"last_affected":"fd43dc466e1f72f6c3d6d58159aadaf9b8847b68"}],"database_specific":{"cpe":["cpe:2.3:a:puppet:puppet_agent:1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_agent:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_agent:1.3.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.3.0"},{"last_affected":"1.3.0"},{"introduced":"1.3.1"},{"last_affected":"1.3.1"},{"introduced":"1.3.2"},{"last_affected":"1.3.2"}],"source":"CPE_STRING"}}],"versions":["1.3.0","1.3.1","1.3.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2786.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}