{"action":"Upgrade bolt to 3.27.4 or later.","affected":[{"fixed":"3.27.4","introduced":"0"}],"component":"bolt","cve_ids":["CVE-2023-5214"],"ecosystem":"RubyGems","epss":0.00447,"exploited":false,"fixed_versions":["3.27.4"],"ghsa_id":"GHSA-289m-2964-f8q5","id":"tcs_01M5KEFV2WWN4EF7R923AWCFB6","modified_at":"2024-02-16T08:13:05.594543Z","published_at":"2023-10-06T18:30:32Z","references":["https://osv.dev/vulnerability/GHSA-289m-2964-f8q5","https://nvd.nist.gov/vuln/detail/CVE-2023-5214","https://github.com/puppetlabs/bolt","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bolt/CVE-2023-5214.yml","https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-bolt","https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-289m-2964-f8q5","url":"https://osv.dev/vulnerability/GHSA-289m-2964-f8q5"}],"summary":"Puppet Bolt privilege escalation vulnerability"}