{"action":"Upgrade puppet to 2.7.18-3 or later.","affected":[{"fixed":"2.7.18-3","introduced":"0"}],"component":"puppet","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:11","exploited":false,"fixed_versions":["2.7.18-3"],"id":"tcs_01M5NAAKEPFQ4YBKX9AVJ7JPN4","modified_at":"2026-08-04T06:03:35.557958279Z","published_at":"2013-03-20T16:55:01.790Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2013-1654","https://security-tracker.debian.org/tracker/CVE-2013-1654"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2013-1654","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2013-1654"}],"summary":"Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to co"}