Information Exposure Affecting puppet package, versions <3.6.2


0.0
medium

Snyk CVSS

    Attack Complexity Low
    Confidentiality High

    Threat Intelligence

    EPSS 0.11% (44th percentile)
Expand this section
NVD
6.5 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-PUPPET-20330
  • published 28 Feb 2017
  • disclosed 10 Jun 2014
  • credit Puppet Labs

How to fix?

Upgrade puppet to version 3.6.2 or higher.

Overview

puppet is an automated configuration management tool. Affected versions of the package are vulnerable to Information Leakage.

In Apache 2.4, SSLCARevocationCheck directive was added to mod_ssl, which defaults it to none and must be explicitly configured. This setting enables checking of a certificate revocation list. The default Puppet master vhost config shipped with Puppet does not include this setting. If a Puppet master is set up to run with Apache 2.4, and this default vhost configuration file is used, the Puppet master will continue to honor a host's certificate even after it is revoked.