CVE-2014-3251

no score yetEPSS 0.2%

The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
CWE: CWE-362
Published: 2014-08-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

puppet:puppet_enterprise
puppetlabs:mcollective

References

http://puppetlabs.com/security/cve/cve-2014-3251
http://secunia.com/advisories/59356
http://secunia.com/advisories/60066
http://www.osvdb.org/109257
http://puppetlabs.com/security/cve/cve-2014-3251

Check your stack JSON