CVE-2020-7942

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-7942
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7942.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-7942
Aliases
Downstream
Related
Published
2020-02-19T21:15:11Z
Modified
2026-07-08T17:57:02Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the default node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting strict_hostname_checking = true in puppet.conf on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19

References

Affected packages

Git / github.com/puppetlabs/puppet

Affected ranges

Type
GIT
Repo
https://github.com/puppetlabs/puppet
Events
Introduced
ceec9d2b6ab716cf90c2f8f4384632ebd1afc338
Fixed
3464ca6e1ef3ff3a5cbdb0f4cf70417286cc1407
Introduced
06ad255754a38f22fb3a22c7c4f1e2ce453d01cb
Fixed
102680c80f24517344763759ea849264efd237cc
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.5.0"
        },
        {
            "fixed": "5.5.19"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.13.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7942.json"

Git / github.com/puppetlabs/puppet-agent

Affected ranges

Type
GIT
Repo
https://github.com/puppetlabs/puppet-agent
Events
Introduced
b751de70df995fc1a19f279311df406888bb7031
Fixed
9ec85f17dd7d64ea568c5b27dbad9e983b4244e9
Introduced
824456d7fb443ae27899f1687a604777bb991045
Fixed
242c2bfa65219a6227780126d57fd7de86c33674
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:puppet:puppet_agent:*:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "5.5.0"
        },
        {
            "fixed": "5.5.19"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.13.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7942.json"