Mcollective

This hub aggregates every CVE we track for Mcollective, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 4 most recently published vulnerabilities affecting Mcollective.

• CVE-2014-0175mcollective has a default password set at install9.8Dec 13, 2019
• CVE-2017-2292Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML....9.0Jun 30, 2017
• CVE-2017-2298The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to write a file to a...6.5Jun 30, 2017
• CVE-2014-3251The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which al...4.4Aug 12, 2014