RubyGems/bolt CVE-2023-5214: critical 9.8, EPSS 0.45%

Puppet Bolt privilege escalation vulnerability

Action: Upgrade bolt to 3.27.4 or later.

bundle update bolt

Affected

Fixed versions

Sources

• osv: GHSA-289m-2964-f8q5
• https://nvd.nist.gov/vuln/detail/CVE-2023-5214
• https://github.com/puppetlabs/bolt
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bolt/CVE-2023-5214.yml
• https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-bolt
• https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates

CVE-2023-5214 · published 2023-10-06T18:30:32Z · modified 2024-02-16T08:13:05.594543Z · JSON