CVE-2020-7942
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-7942
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7942.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-7942
- Aliases
- Related
- Published
- 2020-02-19T21:15:11Z
- Modified
- 2024-09-03T03:33:07.485757Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the
defaultnode, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by settingstrict_hostname_checking = trueinpuppet.confon your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for stricthostnamechecking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set stricthostnamechecking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19 - References
Affected packages
Debian:11 / puppet
Package
- Name
- puppet
- Purl
- pkg:deb/debian/puppet?arch=source