Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1426
Reference (s):
- http://puppetlabs.com/security/cve/cve-2015-1426