CVE-2015-7328: Puppet Enterprise

Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors.

Affected products

• Puppet Puppet Enterprise: version 3.8.0 only; version 3.8.1 only; version 3.8.2 only; version 2015.2.0 only; version 2015.2.1 only; version 2015.2.2 only

Published 2016-01-08. Last modified 2026-06-17.